metamaskextension-cloud[.]pages[.]dev

The domain metamaskextension-cloud.pages.dev was registered on February 21, 2026 and is hosted on Cloudflare's network (AS13335) with the IP address 188.114.97.3 located in the United States. The site resolves to two Cloudflare nameservers, brit.ns.cloudflare.com and alec.ns.cloudflare.com, and serves an SSL certificate issued by Google Trust Services under the WE1 root. HTTP requests receive a 403 response, and the page title returned by the server is “Suspected phishing site | Cloudflare”. The site is flagged by Google Safe Browsing for social engineering and appears on at least one public security blocklist, where it has been actively blocked by PhishDestroy.

VirusTotal analysis shows that 14 of 95 scanned security vendors generated a detection for the domain, indicating a moderate to high degree of malicious confidence. Independent reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100), reinforcing the assessment that the domain is being used for a crypto‑related scam. The infrastructure employs HSTS and HTTP/3, typical of Cloudflare‑protected sites, but no further content analysis is available beyond the generic phishing page title.

The domain explicitly impersonates the MetaMask brand, targeting users of the cryptocurrency wallet extension. Defenders should add the domain to internal block lists, monitor for any DNS or TLS fingerprinting that might indicate reuse of the same IP or nameserver configuration, and enforce web‑filter policies that block connections to the identified IP address and any subdomains under pages.dev that resolve to Cloudflare nodes with similar SSL characteristics. Because the site is currently offline, ongoing surveillance is advised to detect potential re‑hosting attempts under new subdomains or similar naming patterns.