mnetamask-chorme-extension[.]pages[.]dev

This domain, mnetamask-chorme-extension.pages.dev, has been assessed as a high-risk crypto drainer designed to steal cryptocurrency assets by impersonating the popular MetaMask wallet extension. The site attempted to trick users into believing it was a legitimate browser extension update, but instead deployed malicious scripts to drain wallets. PhishDestroy categorizes this as a generic phishing threat with a specific focus on cryptocurrency theft, making it particularly dangerous for crypto users.

Technical indicators confirm the malicious nature of this domain. VirusTotal reports that 16 out of 95 security vendors flagged the domain as malicious, providing strong collective evidence. Google Safe Browsing has specifically flagged it for phishing. The domain was created on October 8, 2025, and registered through Cloudflare, Inc., which also provides the SSL certificate via Google Trust Services (WE1). It resolved to IP address 172.66.47.197 and appeared on one security blocklist. The page title was 'Suspected phishing site | Cloudflare,' indicating that Cloudflare's own systems had already taken it offline. Despite being offline now, the domain remains a threat if reactivated.

Users who may have interacted with this domain should take immediate action. Since this was a crypto drainer, affected individuals should revoke any token approvals granted to suspicious contracts and transfer remaining funds to a new, secure wallet. Change passwords for any accounts where the same credentials were used, enable two-factor authentication, and run a full antivirus scan. Report the domain to relevant authorities and monitor blockchain activity for unauthorized transactions. Staying vigilant against similar domains that mimic legitimate crypto services is crucial to avoid future attacks.