crypto-metamsk-login[.]pages[.]dev

The domain crypto-metamsk-login.pages.dev was registered on June 08, 2026 via the Cloudflare Pages service. Since its creation the domain has been observed in three independent security blocklists and is actively listed by the PhishDestroy, MetaMask, and SEAL blocklists, indicating that multiple threat‑intelligence feeds have identified it as malicious. VirusTotal scans show that ten out of ninety‑one participating security vendors have flagged the domain, confirming a non‑trivial detection rate across automated analysis engines. The threat is categorized as credential phishing, targeting users of the MetaMask wallet extension. The domain is currently marked as active and assigned a high risk level by the reporting system.

Evidence confirms that the domain’s hosting infrastructure is provided by Cloudflare, a reputable provider, but the use of a legitimate CDN does not mitigate the malicious intent. No additional data on IP address, autonomous system number, or geographic location is available in the supplied intelligence, leaving the underlying network footprint uncertain. Likewise, details such as SSL certificate properties, HTTP response codes, or page title have not been disclosed, so the surface‑level characteristics of the landing page remain unverified. Because the domain leverages the pages.dev sub‑domain, it benefits from Cloudflare’s default SSL termination, which can give the site a legitimate‑looking HTTPS indicator. However, the presence of the domain on multiple blocklists and the vendor detections outweigh any perceived trust from the TLS certificate.

No evidence of a redirect chain or additional malicious payloads has been publicly released, so analysts should assume the primary objective is credential harvesting. Defenders should treat any traffic to crypto-metamsk-login.pages.dev as hostile.