faqsmetamask-chrm-extension[.]pages[.]dev

The domain faqsmetamask-chrm-extension.pages.dev is a phishing site targeting MetaMask users, exploiting the popularity of cryptocurrency wallets. It has been flagged by 12 out of 93 vendors on VirusTotal, indicating a significant level of threat recognition. Google Safe Browsing also lists this domain as malicious, reinforcing its status as a security risk.

This domain was registered through Cloudflare, Inc. and hosted on an IP address in the United States, specifically 104.21.48.1, under the organization AS13335 Cloudflare, Inc. The site's SSL certificate was issued by SSL Corporation via Cloudflare TLS Issuing ECC CA 3. Despite being taken down and currently offline, it was active long enough to be detected by PhishDestroy on February 26, 2026.

The phishing operation likely aimed to deceive users into revealing sensitive information by impersonating MetaMask, a well-known cryptocurrency wallet service. The platform risk score of 88/100 highlights the potential damage such a site could inflict if users were successfully duped. The rapid detection and flagging by multiple security entities underscore the importance of timely threat identification. This case exemplifies the ongoing challenge of protecting users against sophisticated phishing schemes in the cryptocurrency space.