metamas-login-uin[.]pages[.]dev

This domain, metamas-login-uin.pages.dev, was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.46.222, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that access is being denied, consistent with the domain being taken offline after detection. The TLS certificate is issued by Google Trust Services under the WE1 root, providing a valid HTTPS connection but offering no assurance of legitimacy. The domain is flagged by Google Safe Browsing for social engineering and is listed on a single security blocklist. Multiple security vendors have evaluated the host on VirusTotal, with 15 of 93 scanners marking it as malicious.

Reputation services assign extremely low scores: Scamadviser rates the site 1 / 100 and Gridinsoft 0 / 100, reinforcing the classification as a crypto‑related scam. The site is identified as impersonating the MetaMask brand and is categorized as a crypto scam. HSTS, Cloudflare and HTTP/3 are observed, which are typical of legitimate services but also commonly used by malicious actors to gain trust. Nameservers samara.ns.cloudflare.com and chris.ns.cloudflare.com are standard Cloudflare delegations.

The domain has been blocked by PhishDestroy and is currently offline, limiting immediate exposure but indicating prior active use. Uncertainty remains regarding the exact phishing kit or payload because no page content beyond the title has been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host or similar subdomains, and correlate logs for connections to 172.66.46.222.