secure-metamsk-welcomes[.]pages[.]dev

Analysis of secure-metamsk-welcomes.pages.dev shows multiple indicators of credential phishing activity. The domain was created on February 21, 2026 and registered through Cloudflare, Inc., using the authoritative nameservers melina.ns.cloudflare.com and micah.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.202, which belongs to AS13335 Cloudflare and is geolocated in the United States. The site serves a TLS certificate issued by Google Trust Services under the WE1 hierarchy, confirming the use of a valid HTTPS endpoint. HTTP responses return a 403 status code and the server advertises HSTS and HTTP/3, consistent with Cloudflare‑hosted services.

The page title returned by the server is "Suspected phishing site | Cloudflare," reinforcing the classification as a phishing landing page. Google Safe Browsing has flagged the domain for social engineering, and the Gridinsoft trust score is 0 out of 100, indicating an extremely low reputation. VirusTotal reports that 15 out of 93 scanned security vendors flag the domain, demonstrating a consensus of malicious intent across multiple detection engines. The domain appears on one known security blocklist and is actively blocked by PhishDestroy, further confirming its inclusion in threat intelligence feeds.

While the exact payload or credential‑harvesting mechanics are not publicly disclosed, the combination of registrar abuse, Cloudflare hosting, low trust scores, and multiple vendor detections provides concrete evidence of a credential phishing operation. Defenders should immediately block network traffic to 172.66.47.202 and add secure-metamsk-welcomes.pages.dev to URL filtering policies. Continuous monitoring of Cloudflare‑registered domains with recent creation dates is advised, as similar infrastructure may be reused for future campaigns.