support-metaamsk-extansion[.]pages[.]dev

This domain, support-metaamsk-extansion.pages.dev, is identified as a high-risk phishing site designed to impersonate the MetaMask cryptocurrency wallet service. Analysis indicates the infrastructure was specifically crafted to deceive users into divulging wallet recovery phrases or private keys through a fraudulent support interface. The phishing kit appears generic but employs social engineering tactics common to cryptocurrency drainers, including urgency cues and official branding mimicry. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 21, 2025, and resolves to the IP address 188.114.96.3, associated with Cloudflare's US-based autonomous system (AS13335). Detection metrics show 11 out of 95 security vendors flagged this domain on VirusTotal, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title, 'Suspected phishing site | Cloudflare,' suggests prior automated detection by the hosting provider. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the registrar or hosting provider. However, residual risk persists as threat actors may re-deploy the phishing kit under a new domain or infrastructure. Users who interacted with this domain are advised to revoke any connected wallet sessions, monitor for unauthorized transactions, and verify the legitimacy of any cryptocurrency-related communications through official channels only.