eng-metmsskio-us-web[.]pages[.]dev

PhishDestroy has identified the domain eng-metmsskio-us-web.pages.dev as a high-risk brand impersonation threat specifically targeting MetaMask users. This domain is currently offline, but during its active period it posed a significant danger to anyone seeking legitimate MetaMask services. The site was designed to steal login credentials and sensitive information from unsuspecting victims.

Technical analysis reveals that this domain was registered through Cloudflare, Inc. on October 30, 2025, and resolves to IP address 172.66.45.16. It was flagged by 11 out of 95 VirusTotal vendors as malicious, and appears on one security blocklist. Google Safe Browsing also flagged it for phishing activity. The SSL certificate was issued by Google Trust Services under WE1, giving the fraudulent site a false sense of security. The page title was "MetaMask Login - Getting Started with MetaMask," which directly impersonates the legitimate MetaMask interface.

Given that the domain is now offline, the immediate threat is contained. However, users should remain vigilant against similar phishing attempts. PhishDestroy recommends that anyone who may have visited this domain or entered credentials should immediately change their MetaMask passwords and enable two-factor authentication. Always verify URLs before entering sensitive information, and use official MetaMask channels for support and login. For ongoing protection, consider using a reputable anti-phishing extension and reporting suspicious domains to relevant authorities.