metamask-io-extension[.]pages[.]dev

The domain metamask-io-extension.pages.dev was registered through Cloudflare on 21 February 2026 and resolves to the Cloudflare‑owned address 172.66.44.73 (AS13335, United States). DNS resolution uses the Cloudflare nameservers roman.ns.cloudflare.com and lorna.ns.cloudflare.com. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1) and enforces HSTS, indicating an HTTPS‑only configuration. HTTP requests return a 403 status code and the page title reported by the server is “Suspected phishing site | Cloudflare”, which is a generic Cloudflare block page rather than content hosted by the attacker. Multiple reputation services flag the domain as malicious.

Gridinsoft assigns a trust score of 0 / 100 and Scamadviser a score of 1 / 100, both indicating extreme risk. VirusTotal analysis shows that 15 of 93 scanned security vendors flag the domain, corroborating the malicious classification. Google Safe Browsing lists the site under the “social engineering” category, and the domain is currently listed on at least one public blocklist, including PhishDestroy. The brand target is MetaMask and the scam type is identified as a crypto‑related impersonation, consistent with the “brand impersonation” threat label. Defenders should block all traffic to the domain and add the IP address 172.66.44.73 to deny lists, recognizing that the address belongs to a shared Cloudflare network and may host other unrelated services.

Monitoring for newly created subdomains under pages.dev that reference MetaMask or other crypto wallets is advisable, as attackers often reuse the same hosting infrastructure. Because the site is presently offline, any residual caching or DNS records may still resolve to the malicious IP, so forced DNS TTL refreshes are recommended. Continuous re‑scanning with VirusTotal and other multi‑engine services will help capture any re‑activation or changes in the payload.