begin-doc-mmetamsk-omg[.]pages[.]dev

The domain begin-doc-mmetamsk-omg.pages.dev was created on February 21, 2026 and is currently taken offline. Technical inspection shows the site was hosted behind Cloudflare, resolving to IP address 172.66.47.135, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate presented was issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint, but the HTTP response returned a 403 status code, suggesting the content was inaccessible at the time of testing. Page metadata revealed the title "Suspected phishing site | Cloudflare," and the classification from the supplied intelligence identifies the activity as credential phishing.

Reputation metrics are extremely low, with Gridinsoft assigning a score of 0 out of 100 and Scamadviser reporting a trust score of 1 out of 100. VirusTotal analysis recorded 13 detections out of 93 scanned security vendors, confirming that multiple AV engines flag the domain as malicious. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing its malicious reputation. Nameserver configuration uses rayne.ns.cloudflare.com and nikon.ns.cloudflare.com, both Cloudflare‑managed, which is typical for abuse‑hosted infrastructure.

Observed technologies include HSTS enforcement, Cloudflare’s edge services, and HTTP/3 support. While the site is offline, the combination of a recent registration date, low trust scores, multiple vendor detections, and active blocklisting provides sufficient evidence to treat the domain as a confirmed credential‑phishing threat. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑appearance of the host under the same IP or nameserver set, and consider adding the IP address 172.66.47.135 to threat‑intelligence feeds. Ongoing observation of Cloudflare‑originated domains with similar trust profiles is recommended to pre‑empt future phishing campaigns.