support-metmask-en-webs[.]pages[.]dev

This domain, support-metmask-en-webs.pages.dev, was identified as a brand impersonation threat targeting MetaMask, a cryptocurrency wallet service. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 172.66.47.115, hosted under AS13335 (Cloudflare, Inc.) in the United States. The domain utilized Cloudflare nameservers (ajay.ns.cloudflare.com and hera.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). At the time of assessment, the domain returned an HTTP 403 status, and its page title was explicitly flagged by Cloudflare as 'Suspected phishing site.' Detection data indicates limited but clear malicious classification: the domain appeared on one security blocklist (PhishDestroy) and was flagged by 12 of 93 security vendors on VirusTotal.

Trust scores from Scamadviser and Gridinsoft both rated the domain at 1/100 and 0/100, respectively, reinforcing its high-risk classification. The domain was categorized as a crypto scam, though no further details about the specific phishing kit or payload delivery mechanism are available from the provided intelligence. Defenders should note that while the domain is currently offline, its infrastructure remains a potential vector for future abuse. The use of Cloudflare hosting and nameservers is consistent with phishing campaigns seeking to leverage reputable CDN services for evasion.

The SSL certificate and HSTS implementation do not mitigate the domain's malicious intent, as these are standard features of Cloudflare-hosted sites. Organizations are advised to block the domain and its resolved IP (172.66.47.115) at the network level, monitor for related subdomains or typosquatting variants, and alert users to the MetaMask impersonation risk.