dashboard-pep5nvgl-sahir01-metamask[.]4everland[.]app

The domain dashboard-pep5nvgl-sahir01-metamask.4everland.app is flagged as a brand‑impersonation site targeting MetaMask. Infrastructure analysis shows the hostname resolves to the IP address 188.114.97.3, which belongs to Cloudflare’s network (AS13335) and is geolocated to the United States. Registration information lists Cloudflare, Inc. as the registrar, and the TLS certificate is issued by Google Trust Services under the WE1 root, indicating a legitimate‑looking HTTPS endpoint despite the malicious intent. The site served an HTTP 404 response with the page title “Index” before being taken offline, and the underlying web stack includes Cloudflare services and HTTP/3 support.

Eight of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has also added the hostname to its blocklist, confirming community‑wide detection. The domain is currently marked as offline, but the historical evidence suggests a short‑lived crypto‑scam operation that leveraged MetaMask branding to lure victims.

Uncertainties remain regarding the exact phishing kit used, the presence of any credential‑harvesting pages, and the full scope of malicious activity because no page content was captured before takedown. Defenders should continue to block the resolved IP address and the full hostname, monitor Cloudflare‑associated ranges for similar patterns, and update detection signatures to include the observed TLS certificate chain and HTTP/3 fingerprint. Organizations that enforce brand‑specific allowlists for MetaMask‑related URLs should ensure this subdomain is excluded, and incident‑response teams should treat any traffic to the address as potentially malicious, even though the site is presently offline.