metamask-logine[.]pages[.]dev

The domain metamask-logine.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to the AS13335 Cloudflare network located in the United States. The site is currently marked offline, returning an HTTP 403 status code, and is listed on a single security blocklist. It is actively blocked by PhishDestroy and flagged by Google Safe Browsing for social engineering. VirusTotal analysis shows that 15 of 93 scanned security vendors identified the domain as malicious, reinforcing the high‑risk classification.

The TLS certificate is issued by Google Trust Services under the WE1 subject, and the site enforces HSTS while supporting Cloudflare’s HTTP/3 acceleration. Nameservers are susan.ns.cloudflare.com and randy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. Gridinsoft assigns a trust score of 0 out of 100, and the page title presented by the server is "Suspected phishing site | Cloudflare," which aligns with the observed Cloudflare‑generated block page. The campaign is described as a crypto scam targeting MetaMask users, and the threat level is high.

While the domain’s content has not been publicly captured, the combination of registrar, hosting, SSL, and detection data provides sufficient confidence to treat the domain as a credential‑harvesting vector. Defenders should block the IP 188.114.97.3 at network perimeters, add the domain to URL filtering policies, and monitor for any related C2 infrastructure that may share the same Cloudflare ASN. Continuous re‑evaluation is advised in case the site reappears under a different subdomain or hosting configuration.