ens-meta-maask-entexions-authed[.]pages[.]dev

PhishDestroy identifies ens-meta-maask-entexions-authed.pages.dev as an active brand impersonation domain targeting MetaMask users. This fraudulent site mimics the official MetaMask branding to trick visitors into downloading malicious extensions or revealing sensitive wallet information. The domain’s page title, 'Metamask Extension – Secure Help,' suggests false legitimacy, while its Cloudflare-backed infrastructure obscures the true origin of the threat. With 0 detections out of 95 VirusTotal scans, this domain remains under the radar despite its malicious intent.

This domain was flagged using seed identifier 608d5b, confirming its status as a recent threat with no prior security blocking. Registered through Cloudflare, Inc., the site resolves to IP 172.66.44.60 and holds an SSL certificate issued by Google Trust Services, which may lull users into a false sense of security. The combination of a convincing page title, active hosting, and undetected status makes this particularly dangerous, as victims may unknowingly expose their cryptocurrency wallets or login credentials.

If you visited ens-meta-maask-entexions-authed.pages.dev, disconnect from the internet immediately and scan your devices for malware. Revoke any permissions granted to unknown extensions or websites and change your MetaMask password using an official, verified method. Report the domain to MetaMask’s official support channels and update your browser’s security extensions to block future access. Stay vigilant—legitimate MetaMask resources will never prompt downloads from untrusted domains.