wel-metamask-login[.]pages[.]dev

Analysis of wel-metamask-login.pages.dev shows a high‑risk brand‑impersonation infrastructure targeting MetaMask users. The domain was registered on February 21 2026 via Cloudflare, Inc., and is delegated to the Cloudflare nameservers zariyah.ns.cloudflare.com and javier.ns.cloudflare.com. DNS resolution points to IP 172.66.46.238, which belongs to AS13335 Cloudflare, Inc. in the United States. The site served HTTPS using a Google Trust Services certificate issued to “WE1”, and the response included HTTP Strict Transport Security (HSTS) and HTTP/3, indicating a modern Cloudflare edge configuration.

An HTTP GET returns status code 403 and the page title “Suspected phishing site | Cloudflare”. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 16 of 93 scanning engines have flagged the host, reinforcing its malicious reputation. The Gridinsoft trust score is 0 / 100, and the domain appears on a single security blocklist. PhishDestroy has taken the site offline, and the current status is listed as offline.

The observed indicators collectively point to a crypto‑scam campaign that masquerades as a MetaMask login portal. Uncertainty remains regarding the specific phishing kit or any additional command‑and‑control infrastructure, as no further payload analysis or traffic captures have been published. Defenders should block the domain and its associated IP at perimeter firewalls, update DNS filtering policies to deny resolution of the domain, and monitor for any related C2 indicators tied to Cloudflare‑hosted assets. Continuous threat‑intel feeds should be consulted for newly observed aliases, and incident response teams should treat any authentication attempts to MetaMask originating from this infrastructure as compromised.