support-metamssk-eng[.]pages[.]dev

The domain support-metamssk-eng.pages.dev has been confirmed as a crypto wallet drainer phishing site targeting cryptocurrency users. Analysis indicates this infrastructure was designed to impersonate MetaMask support pages, tricking victims into revealing wallet credentials or authorizing malicious transactions that directly drain funds. The domain is currently offline, though residual risk remains for users who may have interacted with it during its active window. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on November 06, 2025, and resolved to the IP address 188.114.97.3 (AS13335, United States). The domain appears on one security blocklist and is flagged by 14 of 95 VirusTotal security vendors. Google Safe Browsging categorizes it as phishing, while the SSL certificate (Google Trust Services / WE1) was issued to maintain the appearance of legitimacy. The page title explicitly states 'Suspected phishing site | Cloudflare,' though this may have been added post-takedown. Current status indicates the domain has been taken offline, though similar infrastructure may re-emerge under different naming conventions. Users are advised to revoke any wallet authorizations granted during the exposure window (November 6-10, 2025) and monitor connected accounts for unauthorized transactions. Organizations should add the domain and associated IP (188.114.97.3) to internal blocklists, while individuals should verify MetaMask communications exclusively through the official metamask.io domain. Wallet software should be updated to the latest version to mitigate known phishing vectors.