eumetamask-login[.]pages[.]dev

This domain operates as a credential harvesting platform targeting MetaMask wallet users. The site presents a fraudulent login interface designed to mimic the legitimate MetaMask authentication process, capturing entered seed phrases, private keys, or passwords. Analysis indicates the primary objective is immediate cryptocurrency theft through unauthorized wallet access, with potential secondary impacts including identity fraud and further phishing campaigns using stolen credentials. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 24, 2025 through Cloudflare's registrar service and resolves to IP address 172.66.46.248 (AS13335). Security vendor detection shows 14 out of 95 engines flagging the domain as malicious, with Google Safe Browsing specifically categorizing it as phishing. The SSL certificate (Google Trust Services WE1) follows patterns commonly observed in transient phishing infrastructure, while the page title 'Suspected phishing site | Cloudflare' suggests automated detection by the hosting provider's security systems. Users who visited eumetamask-login.pages.dev should assume credential compromise and take immediate containment actions. First, revoke any entered wallet credentials by generating new seed phrases and transferring assets to a new wallet address. Second, perform a full system scan using updated security tools to detect potential malware installed through the phishing interaction. Third, monitor all associated accounts for unauthorized transactions and enable transaction signing requirements for future operations. The domain's current offline status does not eliminate risk, as stolen credentials may be stored for future exploitation. Organizations should add 172.66.46.248 and the domain to network blocklists to prevent access attempts.