metamask-logins[.]pages[.]dev

This domain, metamask-logins.pages.dev, was designed to trick cryptocurrency users into thinking they were visiting an official MetaMask login page. The site was a classic example of brand impersonation, where cybercriminals create convincing replicas of legitimate services to steal login credentials and potentially drain digital wallets. While the site is now offline, its purpose was to harvest sensitive information from unsuspecting visitors.

PhishDestroy flagged this threat after discovering it on October 9, 2025, when the domain was registered through Cloudflare, Inc. Security scans on VirusTotal revealed that 13 out of 95 security vendors flagged the domain as malicious, indicating a high degree of confidence in its harmful nature. Additionally, Google Safe Browsing listed it as a phishing site, and it appeared on one security blocklist. The page title, "Suspected phishing site | Cloudflare," suggests that Cloudflare itself took action to take the site offline, likely in response to abuse reports. The domain resolved to IP address 188.114.97.3 and used an SSL certificate from Google Trust Services, which gave it an air of legitimacy despite its fraudulent intent.

If you visited this domain, you should immediately change your MetaMask password and any other credentials you may have entered. Enable two-factor authentication on your accounts and consider moving any cryptocurrency assets to a new wallet that has never been exposed to this site. Monitor your accounts for unauthorized transactions and report any suspicious activity to the relevant platforms. While the site is now offline, the risk of credential theft remains, so taking these precautions is essential to protect your digital assets.