metamasklogin-en-learn[.]pages[.]dev

This domain, metamasklogin-en-learn.pages.dev, operates as a high-risk brand impersonation portal targeting MetaMask users. Analysis indicates the site presents a fraudulent login interface designed to harvest cryptocurrency wallet credentials and seed phrases. The infrastructure is engineered to deceive users into entering sensitive authentication details, which are then transmitted to threat actors for unauthorized account access and asset theft. The page title, 'Suspected phishing site | Cloudflare,' suggests prior detection, though the domain remained operational until recent takedown efforts. Evidence confirms the domain's malicious intent through multiple technical indicators. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain was registered on October 24, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.185, hosted on AS13335 within the United States. Infrastructure analysis reveals the domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), aligns with patterns observed in other phishing campaigns leveraging Cloudflare Pages. Users who visited metamasklogin-en-learn.pages.dev should immediately revoke any entered credentials and disconnect connected applications from their MetaMask wallet. It is recommended to conduct a full security audit of the affected device, including scanning for malware and reviewing recent transactions. Wallet holders should transfer assets to a new, secure wallet and enable multi-factor authentication where available. If seed phrases were disclosed, assume full account compromise and cease using the exposed wallet. Monitoring for unauthorized transactions and reporting the incident to relevant security teams is advised.