lo-metamask-login-web[.]pages[.]dev

On July 24, 2026 analysts observed that the domain lo-metamask-login-web.pages.dev was provisioned on February 21, 2026 and subsequently taken offline. The site resolved to the IPv6 address 2606:4700:310c::ac42:2d0b, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution leveraged the Cloudflare nameservers seamus.ns.cloudflare.com and marjory.ns.cloudflare.com, confirming that the domain was registered through Cloudflare, Inc. The TLS certificate presented by the server was issued by Google Trust Services under the WE1 designation, indicating a legitimate certificate chain but offering no assurance of benign intent. HTTP requests returned a 403 status code and the page title displayed "Suspected phishing site | Cloudflare," a default block page that Cloudflare serves when a request is denied.

Security telemetry shows that four of ninety‑three VirusTotal scanners flagged the domain, and the domain appears on at least one external blocklist, where it was also listed by PhishDestroy. Additional reputation metrics are extremely poor: Gridinsoft assigned a trust score of zero out of one hundred, and automated fingerprinting identified HSTS, Cloudflare, and HTTP/3 as the underlying technologies. The content was classified as a crypto‑related scam targeting the MetaMask brand, consistent with the "Impersonates: MetaMask" tag.

Although the site is currently offline, the infrastructure demonstrates a typical pattern for brand‑impersonation campaigns that leverage Cloudflare's free hosting and legitimate SSL certificates to gain user trust. Defensive teams should proactively block the fully qualified domain name and its associated IPv6 address, monitor for new subdomains using similar naming conventions, and incorporate the observed indicators into phishing detection rules.