dash-help-metamaskio[.]pages[.]dev

Analysis indicates that the domain dash-help-metamaskio.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and is currently taken offline. DNS resolution points to the Cloudflare edge address 172.66.44.148, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The authoritative nameservers are stella.ns.cloudflare.com and jarred.ns.cloudflare.com, confirming that the domain leveraged Cloudflare’s hosting and CDN services. An HTTP request returns status code 403 and the page title reported by the scanner is “Suspected phishing site | Cloudflare”, indicating that the site was flagged by Cloudflare’s own protection mechanisms.

The TLS certificate is issued by Google Trust Services under the WE1 root, showing a valid HTTPS handshake despite the malicious intent. Reputation services assign very low trust scores: Gridinsoft reports 0/100 and Scamadviser 10/100, both reflecting a high likelihood of abuse. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal records 12 of 93 scanning engines labeling the domain as malicious. The domain appears on a single public blocklist and is specifically listed by PhishDestroy as a blocked entry.

The site is identified as a brand‑impersonation campaign targeting MetaMask and is categorized as a crypto‑scam. Because the infrastructure relies on shared Cloudflare IP space, any network‑level block should be scoped to the fully qualified domain name to avoid collateral impact on legitimate services. Defenders are advised to add dash-help-metamaskio.pages.dev to URL filtering rules, monitor the associated IP 172.66.44.148 for any future malicious activity, and ensure that endpoint protection solutions incorporate the Google Safe Browsing and VirusTotal verdicts. Continuous observation of Cloudflare‑registered domains that mimic MetaMask is recommended, as the rapid creation date suggests a short‑lived campaign that may re‑appear under a different subdomain.