web3-dapps-us[.]pages[.]dev

This domain, web3-dapps-us.pages.dev, is flagged for high-risk brand impersonation targeting MetaMask, a widely used cryptocurrency wallet. Analysis indicates the site presents itself as an official Web3 wallet interface, using the page title 'Exodus Web3 Wallet — Explore Web3 Securely' to deceive users into entering sensitive credentials or seed phrases. The infrastructure is designed to mimic legitimate wallet services, likely deploying a wallet drainer kit to siphon digital assets upon user interaction. Infrastructure analysis reveals concrete technical indicators: the domain resolves to IP address 188.114.97.3 and was registered on September 20, 2025, through Cloudflare, Inc. Security assessments show 11 out of 95 vendors on VirusTotal flagging the domain as malicious, while it appears on three distinct security blocklists, including industry-specific threat intelligence feeds. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend superficial legitimacy to fraudulent sites. No detection by Google Safe Browsing (GSB) is currently recorded, though this does not diminish the confirmed malicious classification. As of the latest assessment, the domain remains active and unmitigated, posing an ongoing threat to users. Response actions by security entities such as PhishDestroy, MetaMask’s internal threat team, and SEAL have resulted in partial blocking, though the site continues to resolve and serve content. The remaining risk is classified as high due to the domain’s recent creation, confirmed malicious activity, and persistent accessibility. Users are strongly advised to avoid interaction, verify wallet interfaces through official channels, and employ browser-based or endpoint security tools capable of detecting and blocking credential theft attempts.