metamesk-io-en[.]pages[.]dev

This domain, metamesk-io-en.pages.dev, operates as a credential harvesting phishing site specifically targeting MetaMask wallet users. Analysis indicates the infrastructure is designed to mimic legitimate cryptocurrency wallet interfaces, tricking victims into entering sensitive authentication details such as seed phrases, private keys, or login credentials. The attack vector appears to leverage social engineering tactics common in cryptocurrency phishing, where users are redirected or lured to the fraudulent page through malicious links in emails, social media, or compromised websites. The domain's focus on MetaMask—a widely used Ethereum wallet—amplifies its risk, as stolen credentials could lead to immediate and irreversible financial losses. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on October 15, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). Security vendors have flagged this domain extensively: VirusTotal reports 10 out of 95 engines detecting malicious activity, while Google Safe Browsing has classified it as phishing. The domain appears on at least one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate. The page title, 'Suspected phishing site | Cloudflare,' further confirms its deceptive nature, as Cloudflare's default warning page is often abused by threat actors to mask their infrastructure. Users who visited metamesk-io-en.pages.dev should assume their credentials or sensitive information may have been compromised. Immediate actions include revoking access to any connected MetaMask or cryptocurrency wallets, generating new seed phrases, and monitoring accounts for unauthorized transactions. If login details were entered, victims should scan their systems for malware, as phishing sites often deploy additional payloads. It is also recommended to report the incident to relevant platforms, such as cryptocurrency exchanges or wallet providers, to prevent further exploitation. Given the domain's current offline status, users should remain vigilant for similar attacks, as threat actors frequently rotate infrastructure to evade detection.