metta-maskk-logn-in[.]pages[.]dev

PhishDestroy identifies an active crypto drainer domain, metta-maskk-logn-in.pages.dev, currently under investigation for mimicking Metamask’s login interface to trick users into surrendering private keys and draining wallets. This fraudulent site, registered through Cloudflare (188.114.97.3), leverages Google Trust Services’ SSL certificate to appear legitimate, yet remains undetected by VirusTotal (4/95 engines) as of the most recent scan. The domain’s rapid deployment on Cloudflare Pages and absence from blocklists indicate a newly activated campaign targeting cryptocurrency holders seeking quick access to their assets. This domain’s operational footprint reveals several red flags: it resolves to IP 188.114.97.3, a Cloudflare IP space often abused for phishing due to its reputation for fast provisioning and anonymity. VirusTotal’s 4/95 detection rate suggests evasion of signature-based defenses, a common trait among sophisticated drainer campaigns that rely on dynamic infrastructure and short-lived domains. The use of Google Trust Services’ SSL certificate further underscores the attackers’ effort to bypass browser security warnings, while the Cloudflare registrar affiliation enables rapid domain cycling to evade takedown efforts. Despite its current low detection rate, the domain’s alignment with known Metamask impersonation tactics—such as obfuscated JavaScript and fake wallet login prompts—confirms its malicious intent. Mitigation for this threat requires immediate caution from users: never enter private keys or seed phrases into non-official Metamask interfaces, and verify links via PhishDestroy’s threat database before clicking. Block the IP 188.114.97.3 at the network level to prevent access, and report the domain to Cloudflare’s abuse team for takedown. For wallet users, enable hardware wallet integration and revoke any suspicious token approvals via tools like Etherscan’s token approval checker. Always cross-reference URLs against Metamask’s official domains (metamask.io) and avoid third-party domains offering wallet-related services. Proactive monitoring of new domains using tools like PhishDestroy’s real-time feed can prevent exposure to similar campaigns.