metawallet[.]pages[.]dev

Analysis of the domain metawallet.pages.dev, observed on July 23, 2026, identifies it as a confirmed crypto‑related scam that impersonates the MetaMask brand. The site was registered on November 24, 2025 and is hosted behind Cloudflare, Inc., as indicated by the authoritative nameservers harlee.ns.cloudflare.com and matt.ns.cloudflare.com. DNS resolution points to IP address 172.66.44.61, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The TLS certificate presented by the server is issued by Google Trust Services under the WE1 intermediate, confirming the use of a valid, publicly trusted certificate chain.

An HTTP request to the site returns a 403 status code, and the page title returned by the server is "MetaMask Help Center," directly referencing the targeted brand. Security telemetry shows the domain appears on a single blocklist and is actively blocked by PhishDestroy. VirusTotal scans have flagged the domain by 13 of 95 security vendors, reinforcing its malicious reputation. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of abuse.

Detected web technologies include HTTP/3, HSTS, and Cloudflare’s edge services, which are typical of fast‑moving phishing infrastructure. The domain is currently offline, suggesting the operators have taken it down or are rotating infrastructure. While the site content has not been captured beyond the page title, the combination of brand impersonation, crypto scam classification, low trust score, multiple vendor detections, and blocklist presence provides strong evidence of malicious intent. Defenders should update network and DNS filtering policies to block both the domain and its associated IP address, monitor for re‑use of the underlying Cloudflare account, and incorporate the observed indicators into threat‑intel feeds to pre‑empt future deployments of similar impersonation campaigns.