mettamsk-login[.]pages[.]dev

Analysis of the domain mettamsk-login.pages.dev indicates a high-risk phishing campaign impersonating MetaMask, as evidenced by multiple technical and reputational signals. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IPv6 address 2606:4700:310c::ac42:2d2e, hosted on Cloudflare's infrastructure (AS13335). Nameservers sid.ns.cloudflare.com and collins.ns.cloudflare.com further confirm Cloudflare as the hosting and DNS provider. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare's typical deployment patterns, though this does not mitigate the domain's malicious classification. At the time of assessment, the domain is offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' which suggests Cloudflare's automated detection systems flagged the content prior to takedown.

Reputational checks reveal consistent warnings: Gridinsoft and Scamadviser both assign trust scores of 0/100 and 1/100, respectively, while Google Safe Browsing classifies the domain as engaging in social engineering. PhishDestroy has blocked the domain, and it appears on at least one security blocklist. Sixteen of 95 security vendors on VirusTotal flagged the domain as malicious, though the absence of additional context limits the granularity of these detections. Infrastructure analysis reveals the use of modern web technologies, including HTTP/3 and HSTS, which are common in both legitimate and malicious deployments. The domain's structure, incorporating 'mettamsk' in its subdomain, directly targets MetaMask users, aligning with the brand impersonation scam type specified in the intelligence.

While the exact content of the phishing page is not analysed, the combination of brand targeting, low trust scores, and security vendor detections confirms the domain's malicious intent.