is-metamask-free[.]pages[.]dev

PhishDestroy has identified is-metamask-free.pages.dev as a confirmed phishing site that specifically impersonates the MetaMask cryptocurrency wallet brand. This domain was designed to trick users into believing they were accessing a legitimate MetaMask service, likely to steal login credentials, seed phrases, or private keys. The threat type is brand impersonation, and the site's name explicitly suggests a free MetaMask offering, a common lure in crypto phishing campaigns.

Technical indicators paint a clear picture of malicious intent. The domain was created on April 27, 2025, and registered through Cloudflare, Inc. It resolves to IP address 172.66.47.98 and uses an SSL certificate from Google Trust Services (WE1). VirusTotal analysis shows that 14 out of 95 security vendors flagged this domain as malicious. Additionally, the domain appears on three security blocklists, and the page title displayed was "Suspected phishing site | Cloudflare," indicating that Cloudflare itself had already identified it as suspicious. Google Safe Browsing status was not explicitly provided, but the blocklist presence suggests it was likely flagged.

As of the latest intelligence, the domain is offline, meaning it has been taken down or is no longer accessible. This is a positive outcome, but users should remain vigilant as similar domains may appear. PhishDestroy recommends that anyone who may have visited this site or entered credentials should immediately change their MetaMask passwords and enable two-factor authentication. No specific drainer kit was identified, but the risk of credential theft remains high. Users should always verify URLs carefully and only access MetaMask through official channels.