metamesk-wallet-io[.]pages[.]dev

The domain metamesk-wallet-io.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is presently hosted on Cloudflare's network (AS13335) with the IP address 172.66.47.73 located in the United States. The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that the content is blocked at the edge. Infrastructure analysis shows the presence of HSTS, HTTP/3, and a valid SSL certificate issued by Google Trust Services under the WE1 label. The domain resolves via the nameservers kate.ns.cloudflare.com and javon.ns.cloudflare.com, both belonging to Cloudflare.

Reputation data is poor: Gridinsoft assigns a trust score of 0 out of 100, and Google Safe Browsing flags the URL for social engineering. VirusTotal reports that 13 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. The threat type is identified as a crypto drainer, consistent with the broader classification of a crypto scam.

While the exact payload or transaction‑draining mechanism has not been observed, the convergence of low trust scores, multiple vendor detections, and blocklist listings provides sufficient confidence to treat the domain as hostile. Defenders should ensure that outbound connections to 172.66.47.73 are denied, update DNS filtering policies to include the domain, and monitor for any attempts to resolve or contact the associated nameservers. Additionally, incident response teams should flag any user‑reported activity involving this domain and consider broader threat‑intel sharing to accelerate community mitigation.