ef4a407e[.]walsrt[.]pages[.]dev

This domain, ef4a407e.walsrt.pages.dev, was observed hosting a page titled “The Ultimate Crypto Wallet for DeFi, Web3 Apps, and NFTs | MetaMask”. The title directly references the MetaMask brand, confirming a brand‑impersonation campaign aimed at crypto users. The site was registered on 21 February 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.44.79, located in the United States under ASN 13335. Network analysis shows the server enforces HTTP Strict Transport Security and supports HTTP/3, while the TLS certificate is issued by Google Trust Services (WE1), indicating a legitimate certificate chain but not mitigating the malicious intent. The HTTP response returned a 403 status, and the domain is currently offline, possibly after takedown actions.

Reputation services flag the domain heavily. The Gridinsoft trust score is 0 / 100, and the domain appears on three public blocklists. Google Safe Browsing categorises the URL as social engineering. VirusTotal records 14 of 95 scanned security vendors marking the domain as malicious. Additional blocklists include PhishDestroy, MetaMask’s own blocklist, and SEAL.

The combination of brand‑specific page title, low trust score, and multiple vendor detections strongly indicates a high‑risk crypto‑scam operation impersonating MetaMask. Defenders should block any DNS resolution to ef4a407e.walsrt.pages.dev at network perimeter and update web filtering policies to include the domain in reputation‑based deny lists. Email gateways should treat messages containing this URL as malicious, especially those claiming wallet access or transaction verification. Continuous monitoring of Cloudflare‑hosted IP ranges for similar brand‑impersonation patterns is advised, as the infrastructure can be reused for future campaigns.