secure-metamsk[.]pages[.]dev

Analysis of secure-metamsk.pages.dev shows a high‑risk brand impersonation campaign targeting MetaMask. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the nameservers ryleigh.ns.cloudflare.com and lewis.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.175, an address within AS13335 Cloudflare, Inc. in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status, indicating that access was denied when the site was taken offline.

Transport security is enforced via HSTS, and the site leveraged Cloudflare’s HTTP/3 support and a Google Trust Services / WE1 SSL certificate, confirming the use of reputable CDN infrastructure. Detection metrics show a Gridinsoft trust score of 0 / 100 and 13 of 93 security vendors on VirusTotal flagged the domain, while Google Safe Browsing classified it as social engineering. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy.

Given the confirmed impersonation of the MetaMask brand and the aggregation of multiple independent detection signals, defenders should immediately block the domain at perimeter firewalls, DNS resolvers, and proxy filters. Continuous monitoring of Cloudflare‑hosted IP ranges for similar brand‑impersonation patterns is advised, as the infrastructure can be reused for future campaigns. Network telemetry should be reviewed for any recent connections to 172.66.47.175, and endpoint security solutions should be updated to include the domain hash and associated indicators of compromise.