project-metamask[.]pages[.]dev

The domain project-metamask.pages.dev is a confirmed phishing site engaged in brand impersonation targeting MetaMask users. It poses a high-risk cryptocurrency scam designed to deceive victims into disclosing wallet credentials or sensitive information, though no drainer kit was identified. As of the latest verification, project-metamask.pages.dev has been taken offline.

Technical indicators confirm the malicious nature of project-metamask.pages.dev. The domain was flagged by 13 of 95 VirusTotal security vendors, including ChainPatrol, BitDefender, and CyRadar, and is listed on Google Safe Browsing for 'SOCIAL_ENGINEERING'. It appears on one security blocklist (PhishDestroy) and was registered through Cloudflare, Inc. on October 17, 2025. The domain resolves to IP address 172.66.44.155 (US, AS13335 Cloudflare, Inc.) and uses an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Suspected phishing site | Cloudflare', and the site returned an HTTP 403 status. Technologies detected include HSTS, Cloudflare, and HTTP/3.

Victims of project-metamask.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts, enable two-factor authentication, and monitor for unauthorized transactions. Report the phishing domain to MetaMask’s official abuse channels, Google Safe Browsing, and platforms like PhishTank or the Anti-Phishing Working Group to aid in takedown efforts.