metamask-login-support[.]pages[.]dev

The domain metamask-login-support.pages.dev has been identified as a brand impersonation threat specifically targeting MetaMask, a popular cryptocurrency wallet. This domain was designed to deceive users into believing they are accessing legitimate MetaMask login support, but its actual purpose was to facilitate credential theft or crypto drainer activities. The page title was flagged as a suspected phishing site by Cloudflare, indicating that even the hosting provider recognized its malicious nature.

Technical analysis reveals that this domain was registered through Cloudflare, Inc. on October 09, 2025, and its SSL certificate was issued by Google Trust Services (WE1). The domain resolves to IP address 172.66.47.66 and appears on one security blocklist. VirusTotal analysis shows that 14 out of 95 security vendors flag this domain as malicious, providing strong evidence of its harmful intent. Notably, the domain is currently offline, likely due to takedown actions by Cloudflare or other security entities.

The current status of this domain is offline, meaning it no longer poses an active threat. However, users should remain vigilant as similar domains may appear. PhishDestroy recommends that users always verify the authenticity of MetaMask-related URLs by using official channels and avoid clicking on unsolicited links. If users have interacted with this domain, they should immediately change their MetaMask credentials and enable two-factor authentication. While the immediate risk is mitigated, the underlying infrastructure could be reused, so continued monitoring is advised.