public-metamask-com-x[.]pages[.]dev

This domain, public-metamask-com-x.pages.dev, was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.180 located in the United States under ASN 13335. The SSL certificate is issued by Google Trust Services (WE1), indicating a legitimate TLS termination but does not mitigate the malicious intent. The site presented the page title “Suspected phishing site | Cloudflare” and is categorised as a crypto‑scam that impersonates the MetaMask brand. Reputation services provide extremely low scores: Gridinsoft reports a trust rating of 0 / 100, while Scamadviser assigns 1 / 100, and the domain appears on a single security blocklist.

VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain, demonstrating that a minority of AV engines have identified malicious characteristics. PhishDestroy has already added the domain to its blocklist, and the current HTTP response is a 403 status, suggesting the content has been taken offline. Infrastructure analysis reveals the use of standard Cloudflare security headers, including HSTS, and the site served over HTTP/3, indicating a modern configuration that could be leveraged to gain credibility. The nameservers listed are charles.ns.cloudflare.com and roxy.ns.cloudflare.com, both typical of Cloudflare‑hosted domains.

No additional technical artefacts such as malicious payloads or redirection chains are publicly disclosed, leaving the exact phishing workflow unknown. Defenders should continue to block the domain at network perimeter and DNS layers, update any threat‑intel feeds with the observed indicators (domain name, IP address, nameservers, SSL issuer, and the 13 VirusTotal detections), and monitor for future re‑hosting attempts that may reuse the same Cloudflare configuration. Given the brand‑impersonation nature, security awareness training should remind users that legitimate MetaMask communications never originate from a *.pages.dev subdomain.