en-us-metamask-docs[.]pages[.]dev

The domain en-us-metamask-docs.pages.dev was created on 21 February 2026 and is currently taken offline, returning an HTTP 403 status. Infrastructure analysis shows the domain is hosted on Cloudflare, Inc. and resolves to IP address 172.66.47.140, which belongs to AS13335 Cloudflare, Inc. in the United States. The name servers listed are indie.ns.cloudflare.com and josh.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The site presented a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid SSL chain despite the malicious intent. Detected technologies include HSTS enforcement and HTTP/3 support, both typical of Cloudflare‑served sites.

The page title returned by the server was "Suspected phishing site | Cloudflare," a generic block page presented by Cloudflare when malicious content is reported. Reputation data shows that 13 of 93 VirusTotal scanners flagged the domain, and it appears on a single security blocklist. It has been explicitly blocked by PhishDestroy and flagged by Google Safe Browsing for social engineering. The Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment.

The domain is classified as a crypto‑related scam that impersonates the MetaMask brand. While the site is no longer reachable, its recent creation date, Cloudflare hosting, and the combination of detection signals suggest a targeted brand‑impersonation campaign. Defenders should proactively block the domain and its associated IP address, monitor for newly registered subdomains under the pages.dev namespace that reference MetaMask, and update intrusion detection and web filtering rules to reflect the observed SSL issuer, HTTP status, and name server patterns. Continuous threat‑intel feeds should be consulted for any resurgence or related infrastructure reuse.