access-metamsk[.]pages[.]dev

This domain, access-metamsk.pages.dev, is identified as a high-risk crypto drainer phishing site designed to impersonate MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the infrastructure was specifically engineered to harvest wallet credentials and execute unauthorized transactions, draining funds from victim accounts. The use of MetaMask branding in the domain name suggests a targeted campaign against cryptocurrency users, likely leveraging social engineering tactics to deceive victims into disclosing sensitive information. Infrastructure analysis reveals the domain was registered on October 28, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendors on VirusTotal flagged the domain as malicious, with 13 out of 95 detections confirming phishing activity. Google Safe Browsing classifies the domain as phishing, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority, which does not mitigate the domain's malicious intent. The domain is currently offline, likely taken down following detection by security systems. However, residual risk remains for users who may have interacted with the site prior to its deactivation. Victims are advised to immediately revoke any connected wallet sessions, transfer remaining funds to a new wallet, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. Continuous monitoring of similar domains using MetaMask or other cryptocurrency brand impersonation is recommended to mitigate ongoing threats.