secuer-metamask[.]pages[.]dev

The domain secuer-metamask.pages.dev is identified as a high-risk brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. Analysis confirms this domain operates as a phishing site designed to deceive users into disclosing sensitive credentials, including wallet recovery phrases and private keys. The current status of the domain is offline, though prior activity indicates it was actively used for malicious purposes. Infrastructure analysis reveals multiple technical indicators supporting its classification as a phishing domain. The domain is flagged by 17 of 95 security vendors on VirusTotal, a significant detection rate that underscores its malicious nature. It is registered through Cloudflare, Inc. and resolves to the IP address 172.66.44.137, associated with Cloudflare’s network (AS13335). The domain was created on October 25, 2025, and appears on at least one security blocklist. Google Safe Browsing has also marked it as a phishing threat. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate in origin, does not mitigate the domain’s fraudulent intent. Given the domain’s current offline status, immediate risk of interaction is reduced; however, the infrastructure remains a potential threat if reactivated. Users and organizations are advised to treat this domain as compromised and avoid any interaction. Security teams should block the domain and its associated IP address (172.66.44.137) at the network level. Additionally, monitoring for similar domains using the same naming pattern (e.g., incorporating 'metamask' or 'secuer') is recommended to preemptively mitigate related threats. Cryptocurrency users should verify all wallet-related communications through official channels and enable multi-factor authentication to reduce exposure to credential theft.