metamask-us-ai[.]pages[.]dev

Analysis of the domain metamask-us-ai.pages.dev confirms its classification as a high-risk phishing site targeting MetaMask users, with infrastructure and detection patterns consistent with crypto scams. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolves to the IP address 172.66.47.104, hosted on Cloudflare's network (AS13335) in the United States. Nameservers milan.ns.cloudflare.com and bristol.ns.cloudflare.com further tie the domain to Cloudflare's infrastructure, a common hosting choice for both legitimate services and malicious actors due to its accessibility and privacy features. Google Safe Browsing has flagged the domain for social engineering, a designation aligned with phishing activity. As of the report date, the domain appears on one security blocklist, specifically PhishDestroy, and is currently offline, returning an HTTP 403 status.

The page title, 'Suspected phishing site | Cloudflare,' corroborates the malicious classification, though the exact content and mechanics of the phishing kit remain unanalyzed due to the site's inactive status. VirusTotal detections indicate that 12 of 93 security vendors have flagged the domain, providing additional validation of its malicious nature. The SSL certificate, issued by Google Trust Services (WE1), is standard for Cloudflare-hosted domains and does not mitigate the threat. Technologies detected on the domain include HSTS and HTTP/3, which are typical for modern web infrastructure but offer no inherent protection against phishing.

Gridinsoft's trust score of 0/100 further underscores the domain's high-risk status. While the domain is currently offline, defenders should treat it as a confirmed threat vector for MetaMask impersonation. Organizations are advised to block the domain and its resolving IP (172.66.47.104) at the network level, update endpoint protection rules, and monitor for related domains leveraging similar naming conventions or Cloudflare Pages infrastructure.