help-en-metamask-x[.]pages[.]dev

This domain, help-en-metamask-x.pages.dev, was identified as a phishing infrastructure targeting MetaMask users, classified as a crypto scam. Registered on February 21, 2026, through Cloudflare, Inc., the domain resolved to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States. Analysis of its infrastructure reveals the use of Cloudflare nameservers (donna.ns.cloudflare.com and fred.ns.cloudflare.com) and technologies including HSTS and HTTP/3. The SSL certificate was issued by Google Trust Services (WE1).

The domain was flagged by at least one security blocklist and assigned a trust score of 0/100 by Gridinsoft. Thirteen of 95 security vendors on VirusTotal detected the domain as malicious. The page title, 'Suspected phishing site | Cloudflare,' aligns with its classification as a brand impersonation attempt, specifically targeting MetaMask. At the time of this report, the domain returned an HTTP 403 status, indicating it was taken offline or restricted.

Defenders should treat this domain as part of a broader crypto-phishing campaign. While the exact content of the phishing page remains unanalyzed, the available indicators—such as the domain name, brand target, and detection by multiple security vendors—confirm its malicious intent. Organizations are advised to block the domain at the DNS or proxy level and monitor for related infrastructure, particularly those leveraging Cloudflare Pages or similar hosting services. The use of Cloudflare's network for phishing infrastructure is consistent with observed tactics to evade detection and maintain operational resilience.