support-metaamsk-extension[.]pages[.]dev

The domain support-metaamsk-extension.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 188.114.97.3 located in the United States. DNS resolution shows the authoritative nameservers lisa.ns.cloudflare.com and harvey.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site presents the page title "Suspected phishing site | Cloudflare" and has been classified as a tech support scam, a pattern corroborated by its appearance on a single security blocklist and its detection by PhishDestroy.

Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 13 of 93 security vendors have flagged the domain, indicating a moderate level of detection across the threat‑intelligence community. The HTTPS certificate is issued by Google Trust Services under the WE1 designation, while the site enforces HSTS and supports HTTP/3, typical of Cloudflare‑accelerated services. Reputation services assign extremely low trust scores: Scamadviser rates it 1/100 and Gridinsoft 0/100, reflecting a high likelihood of malicious intent.

An HTTP request to the domain returns a 403 status, and the current operational state is listed as taken offline, suggesting the infrastructure may have been abandoned or temporarily disabled. While the available data confirms the domain’s association with a tech‑support phishing campaign and its presence on multiple threat‑intel feeds, the exact content of the landing page has not been publicly captured, leaving the specific lure or credential‑capture mechanisms uncertain. Defenders should continue to block the domain at network perimeters, monitor the associated IP range for any resurgence, and incorporate the observed indicators—such as the Cloudflare nameservers, the SSL certificate issuer, and the VirusTotal detection count—into detection rules and threat‑intel feeds to pre‑empt potential re‑use of the infrastructure.