metamask-chrome-exten-sion-6pj[.]pages[.]dev

The domain metamask-chrome-exten-sion-6pj.pages.dev has been identified as a brand impersonation threat specifically targeting MetaMask users. This domain is currently offline, but while active it posed a high risk by attempting to trick users into believing they were accessing legitimate MetaMask services. The page title detected was 'Suspected phishing site | Cloudflare', indicating that Cloudflare had already flagged it as malicious.

PhishDestroy's analysis reveals that this domain was flagged by 12 out of 95 security vendors on VirusTotal, underscoring its malicious nature. It appeared on 1 security blocklist and was flagged by Google Safe Browsing as phishing. The domain was registered through Cloudflare, Inc. on September 03, 2025, and resolved to IP address 172.66.47.64. Its SSL certificate was issued by Google Trust Services / WE1. The combination of these indicators—recent creation date, low trust scores, and widespread vendor flags—confirms the domain was set up for fraudulent purposes.

As of now, the domain has been taken offline, but similar threats may emerge. Users who may have interacted with this domain should immediately change their MetaMask passwords and enable two-factor authentication. To stay safe, always verify URLs through PhishDestroy before entering any credentials or sensitive information. PhishDestroy recommends avoiding any unsolicited links and only accessing MetaMask through its official website or trusted sources.