metamas-k-wallet[.]pages[.]dev

The domain metamas-k-wallet.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which is hosted by Cloudflare (AS13335) in the United States. The site presents the HTTP status code 403 and serves a page titled “Suspected phishing site | Cloudflare”. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming the use of a valid HTTPS endpoint despite the malicious intent. Cloudflare’s infrastructure is evident from the presence of HSTS, HTTP/3 support, and the authoritative name servers newt.ns.cloudflare.com and jule.ns.cloudflare.com.

Google Safe Browsing classifies the domain as a social engineering threat, and VirusTotal records 14 detections out of 93 scanned security vendors, indicating a consensus among multiple scanners that the domain is malicious. Independent reputation services assign low confidence scores: Gridinsoft rates the domain 0 / 100, while Scamadviser reports a 41 / 100 trust rating. The domain has been listed on at least one security blocklist and is actively blocked by PhishDestroy. The overall risk assessment is high, and the current status shows the domain has been taken offline.

Analysis confirms the campaign targets MetaMask users through brand impersonation, as indicated by the declared brand target and the page title referencing a suspected phishing site. No additional content has been captured, so the exact phishing payload or credential‑harvesting mechanisms remain unknown. Defenders should continue to block the IP 188.114.96.3 and the domain itself at DNS and firewall layers, monitor for any re‑registration attempts, and update endpoint protection signatures with the observed VirusTotal detections. Continuous observation of Cloudflare‑hosted abuse reports is recommended, as the infrastructure can be reused for future impersonation attempts.