metamas-login-ui[.]pages[.]dev

The domain metamas-login-ui.pages.dev was observed hosting a brand impersonation campaign targeting MetaMask. The site returned an HTTP 403 response and presented the page title "Suspected phishing site | Cloudflare," indicating that the content had been taken down or blocked. Technical analysis shows the domain resolves to the Cloudflare edge address 188.114.96.3, which is associated with Cloudflare, Inc. in Canada. Nameserver records list sri.ns.cloudflare.com and annabel.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

The domain was registered on February 21, 2026 through Cloudflare, Inc., and the SSL/TLS configuration includes HSTS and HTTP/3 support, consistent with the provider’s default security stack. VirusTotal scanned the domain and recorded two detections out of 93 participating security vendors, reflecting a modest level of consensus among scanners. Independent blocklists have also flagged the host: PhishDestroy, MetaMask, SEAL, and three other security blocklists currently list the domain as malicious. The Gridinsoft trust score is 0 out of 100, indicating a complete lack of trust.

Current intelligence marks the domain as offline, and no active content appears to be reachable. While the available data confirms the presence of brand impersonation infrastructure and multiple detections, the absence of a live payload limits further behavioural analysis. Defensive teams should continue to block the domain at network perimeter devices, update endpoint and DNS threat feeds, and monitor for any resurgence of the host. Coordination with Cloudflare’s abuse reporting channel is recommended to ensure rapid takedown if the site resurfaces.