extension-chroma-matamask[.]pages[.]dev

Analysis indicates that the domain extension-chroma-matamask.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The site presents the page title “Suspected phishing site | Cloudflare” and is classified as a crypto scam that impersonates the MetaMask wallet brand. Network resolution points to the IP address 172.66.44.103, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served behind Cloudflare’s edge network, employing HSTS and HTTP/3, and presents an SSL certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS termination despite the malicious intent. HTTP requests return a 403 status code, suggesting that the content is being deliberately blocked or restricted, and the domain is currently offline.

Reputation services show a Gridinsoft trust score of 0 out of 100 and Google Safe Browsing flags the site for social engineering. VirusTotal analysis reports that 13 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. The domain appears on one external blocklist and has been actively blocked by PhishDestroy, confirming that defensive feeds are already aware of its activity. Nameserver records list noor.ns.cloudflare.com and leif.ns.cloudflare.com, both typical of Cloudflare‑hosted domains.

While the exact payload or credential‑stealing page has not been captured, the convergence of brand impersonation, low trust scores, multiple vendor detections, and blocklist listings provides strong evidence of a high‑risk phishing infrastructure targeting MetaMask users. Defenders should continue to block the domain at network perimeter, update URL filtering and email security policies to include the full domain, monitor for any resurgence of the host, and educate users about unsolicited MetaMask login requests. Ongoing observation is recommended to confirm whether the site is re‑hosted or migrated to new infrastructure.