suport-core-helps[.]pages[.]dev

Analysis conducted on July 23, 2026 shows that the domain suport-core-helps.pages.dev resolves to the Cloudflare edge address 188.114.96.3, which is advertised as being located in the United States under ASN 13335 belonging to Cloudflare, Inc. The site is served over HTTPS with a certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS chain but offering no guarantee of legitimacy. HTTP headers report the presence of HSTS, Cloudflare caching, and HTTP/3 support. The domain was registered on September 02 2020 through Cloudflare, Inc., and the authoritative name servers include adi.ns.cloudflare.com, chase.ns.cloudflare.com, evelyn.ns.cloudflare.com and karl.ns.cloudflare.com. The page title retrieved from the live endpoint reads “Core App vs MetaMask: Which Wallet Offers Better Speed and Native Avalanche Support?”, which directly references the MetaMask brand. The threat classification is listed as brand impersonation with a specific focus on wallet/seed phishing.

The page returned HTTP 403, indicating that the content is not publicly accessible at the time of analysis, and the domain status is currently offline. Reputation metrics show a Gridinsoft trust score of 0 / 100 and a detection rate of 12 of 93 security vendors on VirusTotal, confirming that multiple scanners consider the host malicious. The domain appears on one security blocklist and has been blocked by the PhishDestroy service. The risk level is elevated.

No additional intelligence such as OTX indicators or Safe Browsing entries is available. Given the combination of brand‑specific title, low trust score, multi‑vendor detections, and blocklist inclusion, defenders should treat suport‑core‑helps.pages.dev as a malicious infrastructure targeting MetaMask users. Recommendations include adding the domain and its IP address to local block lists, monitoring for similar “pages.