secure-metamaask-en[.]pages[.]dev

Analysis of secure-metamaask-en.pages.dev indicates a high-risk brand impersonation operation targeting MetaMask users. The domain, registered on February 21, 2026, through Cloudflare, Inc., was taken offline by July 23, 2026, following multiple security detections. Infrastructure analysis reveals the site resolved to Cloudflare’s IPv6 address 2606:4700:310c::ac42:2f99, hosted on AS13335 in the United States. The page title, 'Suspected phishing site | Cloudflare,' aligns with its classification by 14 of 93 security vendors on VirusTotal as malicious, though the exact content of the phishing kit remains unconfirmed. Google Safe Browsing flagged the domain for social engineering, and it appears on at least one security blocklist, including PhishDestroy.

Trust scores from Gridinsoft and Scamadviser both rate the domain at 0/100 and 1/100, respectively, reinforcing its fraudulent nature. The domain employed Cloudflare nameservers (rustam.ns.cloudflare.com, grannbo.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, typical of modern phishing infrastructure. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently use valid certificates. While the domain is currently offline (HTTP 403 status), defenders should treat it as a confirmed threat.

Organizations are advised to block the domain, its resolved IP, and associated Cloudflare nameservers in perimeter defenses. MetaMask users should be alerted to this impersonation attempt, particularly if logs indicate prior visits. Further investigation into the phishing kit’s functionality, if recovered, may reveal additional indicators such as wallet drainer scripts or credential harvesting mechanisms. No evidence suggests this campaign extended beyond this single domain, but monitoring for similar patterns (e.g., 'metamaask' misspellings on Cloudflare Pages) is recommended.