web3-metmaskks-en-cdn[.]pages[.]dev

The domain web3-metmaskks-en-cdn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently listed as offline. DNS resolution points to IP address 172.66.44.91, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are kevin.ns.cloudflare.com and carioca.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. An SSL certificate issued by Google Trust Services (WE1) is present, and the site enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3, confirming the deployment of modern Cloudflare services.

HTTP requests return a 403 status code, and the page title reported by the server is "Suspected phishing site | Cloudflare," which aligns with the classification of a crypto‑related brand impersonation targeting MetaMask. VirusTotal analysis shows that three of ninety‑three security vendors have flagged the domain, and Google Safe Browsing labels it as a social‑engineering threat. The domain appears on three public blocklists and receives a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. It is actively blocked by PhishDestroy, MetaMask’s own mitigation list, and the SEAL blocklist.

The available evidence confirms a high‑risk, brand‑impersonation campaign leveraging Cloudflare’s hosting to masquerade as a MetaMask resource. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no content beyond the page title has been captured. Defenders should immediately block the domain and its associated IP address at network perimeters, update DNS‑based filtering policies, and monitor for any related subdomains or similar Cloudflare‑hosted assets. Continuous observation of VirusTotal, Google Safe Browsing, and blocklist feeds is recommended to capture any further activity or variant deployment.