login-metamask-domain[.]pages[.]dev

Analysis as of July 24, 2026 indicates that login-metamask-domain.pages.dev was registered on 21 February 2026 through Cloudflare, Inc., and resolves to 188.114.97.3, an IP owned by AS13335 Cloudflare, Inc. in the United States. The site serves an HTTPS certificate issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain. HTTP responses return status code 403, and the host advertises HSTS, Cloudflare caching, and HTTP/3 support. The page title observed during the brief scrape was "Coinsquare Login | Trade Digital Assets Securely - NuovoSito", which suggests a credential‑harvesting page targeting the Coinsquare brand, but the listed brand target is "across", indicating the actor may use the same infrastructure for multiple brand impersonations. Two of ninety‑three security engines on VirusTotal flagged the domain as malicious, and three independent blocklists—PhishDestroy, MetaMask, and SEAL—have added it to their phishing collections.

The domain also appears on three other security blocklists. A Gridinsoft trust score of 0 / 100 reinforces the malicious classification. The nameservers are miki.ns.cloudflare.com and yichun.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. Because the site is currently offline, live content cannot be inspected, and the exact payload or credential collection mechanism remains unknown.

However, the combination of a brand‑specific page title, low trust scores, multiple vendor detections, and blocklist listings provides strong evidence that the domain was used for brand‑impersonation phishing. Defenders should update network and endpoint filtering rules to block the resolved IP 188.114.97.3 and the full FQDN, enforce DNS‑level blocking of the domain, and monitor for any future re‑registration of the same subdomain under the pages.dev namespace.