metamask-ie[.]pages[.]dev

This domain, metamask-ie.pages.dev, was identified as a high-risk crypto phishing site targeting MetaMask users. Registered on February 21, 2026, through Cloudflare, Inc., it resolved to IP 172.66.47.115 (AS13335, US) and was hosted on Cloudflare Pages infrastructure. Analysis indicates the domain impersonated MetaMask, a cryptocurrency wallet, aligning with the reported scam type of a crypto scam. Google Safe Browsing flagged the domain for social engineering, while 13 of 93 security vendors on VirusTotal detected malicious activity.

The domain appeared on at least one security blocklist and was blocked by PhishDestroy. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare's automated detection systems may have identified the threat prior to takedown. HTTP status returned a 403, and the SSL certificate was issued by Google Trust Services (WE1). Technologies detected include HSTS and HTTP/3, typical of Cloudflare-hosted sites.

As of July 23, 2026, the domain is offline, but defenders should treat any prior connections or cached references as indicators of compromise. The exact phishing kit or payload remains unconfirmed; however, the combination of brand impersonation, crypto scam classification, and detection by multiple vendors confirms malicious intent. Review logs for interactions with 172.66.47.115 or the domain, and consider blocking the IP and domain across security controls. Further investigation into associated infrastructure (e.g., nameservers noel.ns.cloudflare.com and amber.ns.cloudflare.com) may reveal related threats.