metamask-co[.]pages[.]dev

On July 23 2026, analysts observed that the domain metamask-co.pages.dev was registered on February 21 2026 via Cloudflare, Inc. The domain resolves to the IP address 172.66.44.175, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. DNS resolution is served by the Cloudflare nameservers ashton.ns.cloudflare.com and jacqueline.ns.cloudflare.com. The site presents the page title “Suspected phishing site | Cloudflare” and serves a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS configuration. HTTP responses return a 403 status code, and the server advertises HSTS, Cloudflare edge services, and HTTP/3 support.

Security scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, where it has been flagged by PhishDestroy and subsequently taken offline. VirusTotal analysis shows that 15 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment. The threat classification is a brand‑impersonation campaign targeting MetaMask, described as a crypto‑scam.

Although the page content has not been publicly examined, the combination of a brand‑specific page title, low trust score, blocklist inclusion, and multiple vendor detections provides strong evidence of malicious intent. Defenders should block the domain and its associated IP address at perimeter firewalls and DNS resolvers, monitor for any related Cloudflare‑hosted assets, and educate users about unauthorized MetaMask login prompts. Continuous re‑evaluation is advised in case the infrastructure is re‑hosted or the domain is re‑registered under a new label.