secure-welcome-metamask-logn[.]pages[.]dev

This domain, secure-welcome-metamask-logn.pages.dev, is identified as a high-risk brand impersonation threat targeting MetaMask wallet users. The site mimics legitimate MetaMask login interfaces to deceive users into entering sensitive credentials, including wallet recovery phrases or private keys. Such attacks typically lead to unauthorized access to cryptocurrency wallets, resulting in financial theft and irreversible asset loss. The domain employs social engineering tactics, often leveraging urgency or fake security alerts to manipulate victims into disclosing confidential information. Analysis of the domain infrastructure reveals multiple technical indicators of malicious activity. The domain is flagged by 14 out of 95 security vendors on VirusTotal, indicating broad consensus on its phishing nature. It was registered through a hosting provider on October 13, 2025, and appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to fraudulent sites. The domain resolves to the IP address 188.114.97.3, associated with a US-based autonomous system (AS13335), and is currently offline, likely due to takedown efforts or evasion tactics. Users who accessed secure-welcome-metamask-logn.pages.dev or entered credentials on the site should take immediate action to mitigate risks. First, revoke any active sessions or connected applications linked to the MetaMask wallet. Second, transfer remaining assets to a new, secure wallet with a fresh recovery phrase. Third, monitor the original wallet for unauthorized transactions and report suspicious activity to the platform. Additionally, enable multi-factor authentication on all cryptocurrency-related accounts and verify domain authenticity before entering sensitive information. If recovery phrases or private keys were exposed, assume the wallet is compromised and cease its use entirely.