log-en-meta[.]pages[.]dev

The domain log-en-meta.pages.dev has been identified as a malicious phishing site specifically targeting MetaMask users. This threat is classified as a brand impersonation attack, where the fake login page lures victims into entering their MetaMask credentials and potentially sensitive wallet information. The page was titled "MetaMask Login - Access Web3 Securely," designed to appear legitimate.

Technical analysis reveals that 12 out of 95 security vendors on VirusTotal flagged this domain as malicious, indicating strong consensus within the security community. The domain was registered through Cloudflare, Inc. and resolves to IP address 188.114.97.3. It was created on September 29, 2025, and is protected by an SSL certificate issued by Google Trust Services (WE1). Google Safe Browsing lists the domain as engaging in phishing activity, and it appears on three separate security blocklists.

As of the latest intelligence, the site has been taken offline, but the risk from similar campaigns remains high. The rapid registration and takedown suggest an active threat actor. Users should always verify URLs directly through official channels like PhishDestroy and never enter credentials on pages accessed via unsolicited links. PhishDestroy recommends enabling two-factor authentication and using hardware wallets to mitigate the impact of such phishing attempts.