metamask-io-extention[.]pages[.]dev

This domain, metamask-io-extention.pages.dev, poses a high risk of brand impersonation, specifically targeting the MetaMask brand. The site is designed to deceive users into believing it is an official MetaMask extension, potentially leading to the theft of sensitive information such as private keys and login credentials.

Analysis indicates that the domain is flagged by 15 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion. The domain is registered through Cloudflare, Inc., and was created on October 08, 2025. It appears on one known security blocklist and is currently taken offline. The SSL certificate is issued by Google Trust Services / WE1, and the domain resolves to the IP address 172.66.47.80, located in the United States under the AS13335 Cloudflare, Inc. network. Additionally, Google Safe Browsing has flagged the domain as a phishing site, further corroborating the threat assessment.

If users have visited this domain, they are advised to immediately check their MetaMask accounts for any unauthorized activity. Users should also change their passwords and consider enabling two-factor authentication (2FA) to enhance account security. It is crucial to report any suspicious activity to MetaMask support and to avoid clicking on links or downloading files from unverified sources in the future.