guide-metmaskio-help[.]pages[.]dev

Analysis indicates that the domain guide-metmaskio-help.pages.dev is associated with a brand‑impersonation campaign targeting MetaMask. The domain was registered on September 2 2020 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.47.98 located in the United States under ASN 13335. The site presents a Cloudflare‑generated page titled “Suspected phishing site | Cloudflare” and serves over HTTPS using a Google Trust Services / WE1 certificate. HTTP / 3 is enabled and HSTS is enforced, which are typical of Cloudflare‑hosted infrastructure.

Security telemetry shows that the domain appears on one public blocklist and is listed by PhishDestroy as malicious. VirusTotal scans report that 13 of 93 antivirus and URL‑reputation engines flagged the domain, while Google Safe Browsing classifies it as a social‑engineering threat. The Gridinsoft trust score is 0 / 100, indicating a lack of reputation. Nameserver records include adi.ns.cloudflare.com, carioca.ns.cloudflare.com, karl.ns.cloudflare.com, and kevin.ns.

The HTTP response currently returns 403, and the domain status is marked offline, suggesting the site has been taken down but the infrastructure remains observable. Uncertainty remains regarding the exact payload or credential‑harvesting page because the content has not been captured; the available evidence is limited to infrastructure and reputation signals. Defenders should continue to block the domain and its underlying IP address at network and DNS layers, incorporate the domain into URL filtering and phishing‑prevention rules, and monitor for newly‑registered subdomains that use the same Cloudflare nameservers or similar naming patterns. Ongoing observation of Cloudflare‑hosted IP ranges for related activity is recommended, as the attacker may recycle the infrastructure for future impersonation attempts.