guide-metamask[.]pages[.]dev

The domain guide-metamask.pages.dev is flagged for brand impersonation, specifically targeting the MetaMask brand. No crypto drainer kit has been identified, but the site was suspected to be a phishing site as indicated by the page title and various security flags. The domain's primary threat is the potential for credential theft, misleading users into providing sensitive information under the guise of a legitimate MetaMask service.

Infrastructure analysis reveals that guide-metamask.pages.dev has been flagged by 14 out of 95 security vendors on VirusTotal. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.56, which is located in the United States and is associated with AS13335 Cloudflare, Inc. The domain was created on October 09, 2025, and Google Safe Browsing has marked it as a phishing site. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services / WE1.

Currently, the domain is offline, which suggests that it has been taken down or is no longer active. However, the domain's history of being flagged for brand impersonation and the presence of security warnings indicate that it posed a significant risk when active. Organizations and individuals should remain vigilant and ensure that any cached or redirected links to this domain are updated to avoid potential residual threats. Further, it is advisable to monitor for similar domain registrations and to educate users about the dangers of brand impersonation attacks.