login-mettamask[.]pages[.]dev

Analysis of the domain login-mettamask.pages.dev indicates a high-risk phishing campaign impersonating MetaMask, a cryptocurrency wallet service. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to the IP address 188.114.96.3, which is part of AS13335 (Cloudflare, Inc.) located in the United States. The domain's nameservers, sid.ns.cloudflare.com and collins.ns.cloudflare.com, further confirm its association with Cloudflare's infrastructure. At the time of assessment on July 23, 2026, the domain returned an HTTP 403 status, and its page title was displayed as 'Suspected phishing site | Cloudflare,' suggesting it had been flagged and taken offline by the hosting provider.

The domain was classified as a brand impersonation scam, specifically targeting MetaMask, as confirmed by its inclusion in one security blocklist and its flagging by Google Safe Browsing for social engineering. Gridinsoft assigned a trust score of 0/100, reflecting its high-risk status. Fifteen out of 93 security vendors on VirusTotal detected the domain as malicious, though the exact nature of the threat—whether credential harvesting, crypto-drainer, or another form of attack—remains unconfirmed due to the lack of accessible page content. The SSL certificate, issued by Google Trust Services (WE1), does not provide additional indicators of compromise, as it is consistent with standard Cloudflare-hosted domains.

Defenders are advised to treat this domain as a confirmed phishing threat. While the site is currently offline, historical DNS and WHOIS records should be reviewed for potential connections to other malicious infrastructure. Organizations should ensure that endpoint protection and web filtering solutions block access to this domain and monitor for any attempts to re-register or re-host it under a different name or IP. Given the domain's association with Cloudflare Pages, security teams may also investigate whether other similarly structured domains (e.