help-metamask-doc[.]pages[.]dev

help-metamask-doc.pages.dev is a Cloudflare‑hosted sub‑domain that was observed on 23 July 2026 targeting MetaMask users. The domain was created on 21 February 2026 and registered through Cloudflare, Inc., using the authoritative nameservers sierra.ns.cloudflare.com and morgan.ns.cloudflare.com. DNS resolution points to the IP address 172.66.47.201, which belongs to Cloudflare’s network in Canada. The site presented the HTTP response code 403 and the page title "Suspected phishing site | Cloudflare", indicating that the content was flagged by Cloudflare’s own protection mechanisms.

Security telemetry shows that fifteen of ninety‑three VirusTotal scanners flagged the domain as malicious, and the domain appears on a single external blocklist, currently blocked by PhishDestroy. A Gridinsoft trust score of 0 out of 100 further confirms the lack of credibility. Detected technologies include HTTP/3, HSTS, and the Cloudflare edge platform, all consistent with the hosting provider. The classified scam type is "Crypto Scam", aligning with the impersonation of the MetaMask brand.

As of the report date the domain has been taken offline, but the underlying infrastructure—namely the Cloudflare‑owned IP range and the naming pattern "help‑metamask‑doc"—could be reused for future campaigns. Defenders should add the domain and its associated IP address to blocking rules, monitor for new sub‑domains using the same naming conventions, and consider extending existing phishing‑specific blocklists to cover similar Cloudflare‑hosted assets. Continuous threat‑intel feeds should be consulted for any reappearance, and any inbound traffic to the identified IP should be inspected for anomalous behavior. The combination of low trust scoring, multiple vendor detections, and explicit blocklist inclusion makes the domain a high‑confidence indicator of malicious activity targeting MetaMask users.