safe-metamskio-eng-us[.]pages[.]dev

PhishDestroy has identified safe-metamskio-eng-us.pages.dev as a domain carrying an elevated risk level due to specific brand impersonation tactics. This domain is not a generic phishing site; it is specifically crafted to mimic MetaMask, a popular cryptocurrency wallet, with the goal of stealing login credentials and seed phrases from unsuspecting users. The threat is categorized as a crypto drainer, as successful compromise would lead to direct financial loss.

Technical analysis reveals that 10 out of 95 security vendors on VirusTotal flag this domain as malicious, a strong indicator of its harmful intent. The domain was registered through Cloudflare, Inc. on October 14, 2025, and resolves to IP address 172.66.46.245. Its SSL certificate was issued by Google Trust Services (WE1), lending a false sense of legitimacy. Fortunately, the domain is currently offline and appears on one security blocklist, but it has already been taken down, likely due to Cloudflare's intervention after the threat was reported.

For users who may have encountered this domain before its takedown, immediate action is required. Anyone who entered their MetaMask seed phrase or private keys on this site must assume their wallet is compromised and transfer funds to a new, secure wallet immediately. Enable two-factor authentication on all related accounts and monitor for unauthorized transactions. To avoid future attacks, always verify the URL before entering sensitive information, use official bookmarks, and consider using a hardware wallet for large holdings. PhishDestroy recommends reporting any suspicious domains to security teams and blocklists to protect the broader community.