metamsks-auth[.]pages[.]dev

The domain metamsks-auth.pages.dev is currently active and flagged as a brand impersonation threat specifically targeting users of the Aave decentralized finance platform. Analysis indicates this is a fake login portal designed to mimic MetaMask authentication flows, likely functioning as a crypto credential harvester or wallet drainer. The page title, 'MetaMask Login | Access Your Web3 Wallet Securely,' directly impersonates the legitimate MetaMask interface, creating a high-risk scenario for users attempting to access Aave-related services. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain is flagged by 11 of 95 security vendors on VirusTotal, with registration occurring on October 18, 2025, through Cloudflare, Inc. It resolves to IP address 172.66.44.107, located within Cloudflare's US-based AS13335 network infrastructure. The domain appears on one security blocklist and utilizes an SSL certificate issued by Google Trust Services (WE1). Notably, the creation date is anomalous, suggesting either a typo-squatting attempt or an attempt to evade temporal detection mechanisms. Current status remains active, posing immediate risk to users of decentralized finance platforms. The infrastructure characteristics—particularly the Cloudflare hosting and recent registration—align with common patterns observed in crypto-focused phishing campaigns. Users are strongly advised to avoid interacting with this domain and to verify all authentication portals through official Aave and MetaMask channels. Organizations should implement DNS-based blocking for 172.66.44.107 and monitor for similar impersonation attempts using the same registrar and hosting provider patterns. Wallet providers should consider implementing additional verification steps for users attempting to connect from newly registered domains or Cloudflare-hosted endpoints.