matamask-wallet-net[.]pages[.]dev

matamask-wallet-net.pages.dev is currently flagged as a brand‑impersonation site targeting MetaMask. The domain was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.96.3, located in the United States under ASN 13335. DNS resolution uses the Cloudflare nameservers rick.ns.cloudflare.com and autumn.ns.cloudflare.com. The site presents the page title “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that the content has been taken offline or blocked.

SSL termination is provided by a Google Trust Services / WE1 certificate, and the HTTPS configuration includes HSTS and HTTP/3, both typical of Cloudflare‑served infrastructure. Google Safe Browsing has marked the domain for social‑engineering activity, and VirusTotal records show that 14 of 95 security vendors have flagged the host as malicious. The domain appears on one public blocklist and is explicitly listed by PhishDestroy as a crypto‑scam source. Gridinsoft assigns a trust score of 0 / 100, reinforcing the assessment of high risk.

The only explicit attribution is the “Crypto Scam” label and the statement that the site impersonates MetaMask; no additional technical artifacts such as malicious payloads or credential‑harvesting scripts have been disclosed. Given the available evidence, defenders should treat matamask‑wallet‑net.pages.dev as a high‑confidence impersonation vector. Recommended actions include adding the domain, its resolved IP address, and the associated ASN to deny‑list rules, ensuring that web‑gateway and endpoint protection solutions ingest the Google Safe Browsing and PhishDestroy detections, and monitoring for newly registered subdomains that use similar naming patterns. Continuous re‑evaluation is advised in case the site becomes active again or new indicators emerge.