metmask-ext-io[.]pages[.]dev

Analysis of the domain metmask-ext-io.pages.dev indicates it was a high-risk crypto scam impersonating MetaMask, active until recently taken offline. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate was issued by Google Trust Services (WE1), and the site employed security technologies including HSTS and HTTP/3, alongside Cloudflare's infrastructure. At the time of assessment, the domain returned an HTTP 403 status, and its page title was explicitly flagged by Cloudflare as 'Suspected phishing site.' Detection data reveals the domain was classified as social engineering by Google Safe Browsing and appeared on at least one security blocklist.

Sixteen of 93 security vendors on VirusTotal flagged the domain as malicious, though the absence of additional context limits further interpretation of these detections. The domain's nameservers (natasha.ns.cloudflare.com and kareem.ns.cloudflare.com) and registration details align with Cloudflare Pages, a platform occasionally exploited for hosting phishing infrastructure due to its free tier and rapid deployment capabilities. No evidence confirms the exact mechanics of the scam (e.g., wallet drainer, fake token airdrop, or credential harvesting), but the brand impersonation of MetaMask and classification as a crypto scam suggest it targeted cryptocurrency users.

Defenders should treat this domain as compromised infrastructure and prioritize blocking it at the DNS or proxy level. While the domain is currently offline, historical resolution data and SSL certificate transparency logs may assist in identifying related campaigns or infrastructure reuse. Further investigation into associated IP ranges, certificate issuance patterns, or co-hosted domains on 188.114.96.3 could uncover broader threat clusters.