metamask-extensions-cdn[.]pages[.]dev

PhishDestroy has identified a high-risk phishing campaign targeting MetaMask users via the domain metamask-extensions-cdn.pages.dev. This domain was specifically engineered to impersonate the legitimate MetaMask brand, likely aiming to steal login credentials or deploy a crypto drainer. The threat level is assessed as high due to the targeted brand, the sophisticated infrastructure, and the active security flags. Users who interact with this site risk losing access to their cryptocurrency wallets and funds.

The domain was registered on October 17, 2025, through Cloudflare, Inc., and resolves to IP address 188.114.97.3. It is currently offline, with the page title reading "Suspected phishing site | Cloudflare," indicating that Cloudflare has taken action to block it. Security analysis reveals that 15 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. Google Safe Browsing also flags it as phishing. The SSL certificate is issued by Google Trust Services (WE1), which is standard for Cloudflare-hosted sites, but this does not indicate legitimacy. The unique seed cfdeaf was used to track this specific threat.

To stay protected, MetaMask users should always verify the official website URL (https://metamask.io) and never enter seed phrases or private keys on third-party sites. PhishDestroy recommends bookmarking the official site and using browser extensions that block known phishing domains. If you have already visited this domain, change your MetaMask password immediately and revoke any token approvals. Report any suspicious sites to PhishDestroy for inclusion in our blocklist.