supportmetamask[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically targeting MetaMask users. Analysis indicates the infrastructure is designed to mimic legitimate cryptocurrency wallet support portals, likely deploying credential theft or crypto drainer mechanisms to compromise user accounts and assets. The threat type aligns with known patterns of fraudulent support pages that harvest sensitive wallet recovery phrases or private keys under false pretenses. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain supportmetamask.pages.dev was registered through Cloudflare, Inc. on November 07, 2025, and resolves to IP address 172.66.44.220 (US, AS13335 Cloudflare, Inc.). Security vendors on VirusTotal flagged the domain at 13/95 detection ratio, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), and the page title was identified as 'Suspected phishing site | Cloudflare' before being taken offline. Organizations and users should implement targeted mitigation measures against this brand impersonation threat. Immediately revoke any credentials or recovery phrases potentially exposed to this domain, particularly MetaMask wallet secrets. Monitor cryptocurrency transactions for unauthorized activity and enable multi-factor authentication on all wallet accounts. Security teams should update blocklists with the domain and IP address 172.66.44.220, while conducting retrospective analysis of logs for connections to this infrastructure. Users should be educated to verify official support channels through the legitimate MetaMask website and never enter sensitive information on untrusted portals, regardless of apparent branding consistency.