matamask-extention[.]pages[.]dev

The domain matamask-extention.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP address 172.66.47.9 located in the United States under ASN 13335. The site is currently offline and returns HTTP 403, but the presence of an SSL certificate issued by Google Trust Services (WE1) indicates that HTTPS was previously configured. Infrastructure analysis shows the domain is served by Cloudflare with HSTS and HTTP/3 enabled, consistent with a typical phishing hosting setup. Detection data reveal that 13 of 93 security vendors on VirusTotal flagged the domain, and Google Safe Browsing lists it as a social‑engineering threat. The page title returned by the server is “Suspected phishing site | Cloudflare,” reinforcing the classification as a phishing page.

The brand target is MetaMask and the scam type is identified as a crypto scam involving brand impersonation. Blocklist information shows the domain appears on one security blocklist and is actively blocked by PhishDestroy. A Gridinsoft trust score of 0 out of 100 further indicates a high‑risk profile. The combination of brand impersonation, malicious hosting, and multiple vendor detections elevates the risk to high. Uncertainty remains regarding any active payload or credential harvesting because the site is offline and no content analysis is available.

Defenders should continue to block the domain at network perimeter, add the IP address 172.66.47.9 to deny lists, and monitor for any re‑hosting on alternative Cloudflare edge nodes. Automated detection rules should incorporate the VirusTotal detection count, Google Safe Browsing flag, and the specific page title as indicators of compromise. Incident response teams should treat any credentials or wallet addresses submitted to this domain as compromised and advise affected users to rotate keys and revoke authorizations.