auth-metamask-co[.]pages[.]dev

The domain auth-metamask-co.pages.dev was registered on February 21, 2026 and is hosted behind Cloudflare’s network, resolving to IP address 172.66.47.151, which belongs to AS13335 Cloudflare in the United States. The site returned an HTTP 403 status code and presents the page title "Suspected phishing site | Cloudflare," indicating that Cloudflare has identified the content as malicious. The TLS certificate was issued by Google Trust Services under the WE1 label, confirming the use of a valid HTTPS endpoint despite the underlying malicious intent. Infrastructure analysis shows the presence of HSTS and HTTP/3, both enabled by Cloudflare, and the domain is served by the nameservers mario.ns.cloudflare.com and deborah.ns.cloudflare.com.

Reputation checks reveal that 12 of 93 security vendors on VirusTotal flagged the domain, and Google Safe Browsing classifies it as a social engineering threat. The domain appears on one security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0 out of 100, reflecting the highest level of risk. The reported scam type is a crypto scam that impersonates MetaMask, aligning with the brand target identified in the intelligence. The current operational status is offline, suggesting that the phishing infrastructure may have been taken down or is no longer serving content.

Uncertainty remains regarding the completeness of the payload and whether additional drop sites exist under the same registrar. Defenders should immediately block the domain at DNS and proxy layers, add the associated IP address to network deny lists, and incorporate the observed certificate and HTTP characteristics into detection signatures. Continuous monitoring of Cloudflare‑hosted domains that reference MetaMask or exhibit similar creation dates is recommended to pre‑empt re‑use of the same infrastructure.