get-mettamsk-login[.]pages[.]dev

This domain, get-mettamsk-login.pages.dev, is identified as a high-risk brand impersonation site targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site was designed to deceive users into disclosing sensitive wallet credentials or recovery phrases, likely facilitating unauthorized access to crypto assets. No explicit drainer kit signatures were observed, but the infrastructure aligns with credential theft campaigns commonly associated with wallet hijacking operations. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 8, 2025, and resolves to the IP address 172.66.47.122, hosted under AS13335 (Cloudflare, Inc.) in the United States. Detection metrics include a VirusTotal score of 17/95 security vendors flagging the domain, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on a single security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title, "Suspected phishing site | Cloudflare," suggests the hosting provider may have intervened post-detection. As of the latest assessment, get-mettamsk-login.pages.dev has been taken offline, likely due to enforcement actions by the registrar or hosting provider. However, the risk of reemergence under a similar domain or infrastructure remains. Users who interacted with this site are advised to revoke any connected wallet sessions, rotate recovery phrases, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP to prevent future exposure.