start-metaa-mask-logiin-cloud[.]pages[.]dev

Analysis of the domain start-metaa-mask-logiin-cloud.pages.dev indicates it was a credential phishing site targeting MetaMask users, operational between its creation on February 21, 2026, and its takedown prior to July 24, 2026. The domain resolved to 172.66.44.133, a Cloudflare-hosted IP (AS13335) in the United States, and was registered through Cloudflare, Inc. with nameservers christina.ns.cloudflare.com and viddy.ns.cloudflare.com. SSL certification was issued by Google Trust Services (WE1), and the site employed HSTS and HTTP/3 technologies, typical of Cloudflare-protected infrastructure. Detection data shows the domain was flagged by three security vendors on VirusTotal, though the specific detection rules or payloads are not publicly detailed.

It appeared on three security blocklists and was explicitly blocked by PhishDestroy, MetaMask's internal security systems, and SEAL. The page title, 'Suspected phishing site | Cloudflare,' aligns with Cloudflare's automated phishing detection response, which serves a 403 HTTP status to visitors. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain name itself contains strings ('metaa', 'mask', 'logiin') designed to deceive users into believing it was an official MetaMask login portal, though no direct evidence confirms the exact phishing kit or payload used.

No brand impersonation beyond the MetaMask naming convention is confirmed in available data. Defenders should treat this domain as a confirmed phishing threat, block it at DNS and proxy levels, and monitor for related infrastructure (e.g., sibling domains on the same IP or registrar). Given its offline status, no active payload delivery is occurring, but historical logs should be reviewed for connections to this domain.