metaa-mask-io-eng[.]pages[.]dev

PhishDestroy identifies metaa-mask-io-eng.pages.dev as an active cryptocurrency drainer phishing domain designed to trick users into connecting malicious wallet extensions or divulging private keys. This fraudulent site impersonates legitimate blockchain interfaces to siphon digital assets under the guise of transaction signing. The domain leverages Cloudflare’s infrastructure and Google Trust Services SSL certificates to appear legitimate, while resolving to IP address 172.66.47.3. Threat actors commonly use .pages.dev subdomains to host impersonation pages due to Cloudflare’s free tier, making it critical for crypto users to validate domain origins before any wallet interaction. This domain was flagged by 5 out of 95 VirusTotal security vendors, indicating widespread suspicion among antivirus engines. Registered through Cloudflare, Inc., a common choice for malicious actors due to anonymity protections and rapid deployment capabilities, the site has been active long enough to accumulate limited but concerning visibility. The use of a Google-issued SSL certificate further obscures malicious intent, as browsers display the familiar padlock icon even on fraudulent pages. While no public blocklist count is provided, the combination of low VT detection, active hosting, and crypto-themed deception strongly suggests a high-efficiency drainer operation targeting unsuspecting DeFi users. If you visited metaa-mask-io-eng.pages.dev or entered any credentials, immediately disconnect your wallet, revoke any connected permissions via blockchain explorers like Etherscan or Solscan, and scan your device with reputable antivirus software. Do not interact with wallet prompts or download extensions from this domain. Report the site to PhishDestroy and your browser’s security team to help block future access. Stay vigilant: always verify URLs, use hardware wallets for large transactions, and cross-check domains against official project websites before signing any transactions.