metamak-extension[.]pages[.]dev

This domain, metamak-extension.pages.dev, is actively impersonating MetaMask and Avalanche infrastructure as of July 12, 2026. Analysis indicates the site presents itself as an official Web3 wallet setup guide, with the page title explicitly stating 'MetaMask Extension: Complete Guide to Your Web3 Wallet | Official Setup.' The domain was registered on March 4, 2026, through Cloudflare, Inc., and resolves to IP address 172.66.47.6, hosted on AS13335 (Cloudflare, Inc.) in the United States. Nameservers margot.ns.cloudflare.com and sean.ns.cloudflare.com further confirm Cloudflare as the infrastructure provider, with HSTS and HTTP/3 technologies detected. Security vendor assessments reveal a Gridinsoft trust score of 0/100, and the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Seven of 94 security vendors on VirusTotal flag the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), which, while valid, does not mitigate the domain's fraudulent intent. The HTTP status code 200 confirms the site is currently accessible. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and detection by multiple security mechanisms. Blocking the domain at the DNS or network level is recommended, along with monitoring for related subdomains or IPs within the 172.66.47.0/24 range. The use of Cloudflare infrastructure may complicate takedown efforts, necessitating coordination with the registrar and hosting provider. No specific scam mechanics (e.g., crypto drainer, giveaway) are confirmed beyond the impersonation of MetaMask and Avalanche, but the domain's purpose aligns with typical cryptocurrency phishing campaigns.