secure-metamsk-en[.]pages[.]dev

Analysis of secure-metamsk-en.pages.dev shows a high‑risk brand‑impersonation campaign targeting MetaMask. The domain was created on 2026-02-21 and registered through Cloudflare, Inc., using Cloudflare’s default nameservers (ryleigh.ns.cloudflare.com, lewis.ns.cloudflare.com). DNS resolution points to IP 172.66.47.146, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a valid SSL certificate issued by Google Trust Services (WE1) and enforces HSTS, while serving over HTTP/3, indicating a legitimate CDN configuration rather than a compromised host. The HTTP response returned a 403 status code, and the page title returned by the server is "Suspected phishing site | Cloudflare," confirming that the domain is flagged by the provider’s abuse detection mechanisms.

VirusTotal scans have recorded 15 detections out of 93 security vendors, and Google Safe Browsing categorises the domain as social engineering, reinforcing the malicious intent. Independent blocklist monitoring shows the domain listed on PhishDestroy, and reputational services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). These combined signals indicate an active phishing infrastructure that exploits the MetaMask brand to lure victims.

Because the site is currently offline, content‑level analysis is not possible; however, the observable infrastructure and detection data provide sufficient evidence to classify the domain as a malicious impersonation vector. Defenders should block the domain at perimeter and DNS layers, update web filtering and email security policies to include this indicator of compromise, and educate users about unsolicited MetaMask‑related requests. Continuous monitoring of Cloudflare‑hosted assets is advised, as the attacker may re‑register similar subdomains or shift infrastructure within the same provider.