log-en-metamask-x[.]pages[.]dev

This domain is classified as a high-risk brand impersonation threat explicitly targeting MetaMask, a widely used cryptocurrency wallet. The site employs deceptive tactics to harvest user credentials or facilitate crypto asset theft, posing significant financial and operational risks to individuals and organizations handling digital assets. Analysis indicates the domain was engineered to mimic legitimate MetaMask authentication portals, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain log-en-metamask-x.pages.dev was registered on February 21, 2026, through Cloudflare, Inc. and resolves to the IP address 172.66.47.116, hosted within Cloudflare’s network (AS13335, United States). The domain is flagged by Google Safe Browsing as phishing and appears on one security blocklist. VirusTotal reports 14 out of 95 security vendors detecting malicious activity, with indicators pointing to credential theft and potential crypto drainer functionality. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend superficial legitimacy to phishing infrastructure. The page title, 'Suspected phishing site | Cloudflare,' suggests the domain was identified and partially mitigated by the hosting provider, though it remained active long enough to pose a credible threat. Mitigation requires immediate action from security teams and end users. Network-level blocking of the domain and its resolving IP (172.66.47.116) is recommended to prevent access. Organizations should update endpoint protection rules to detect and quarantine any artifacts associated with this campaign, including related SSL certificates or HTTP request patterns. Users who may have interacted with the domain should assume credential compromise and initiate password resets for MetaMask and any associated accounts. Cryptocurrency wallet holders should verify transaction histories for unauthorized activity and transfer assets to new, secure wallets if exposure is suspected. Security awareness training should emphasize the risks of brand impersonation in crypto-related phishing, particularly the use of lookalike domains and urgency-driven lures.