dash-metamaskio[.]pages[.]dev

dash-metamaskio.pages.dev is a newly registered domain (creation date February 21 2026) that resolves to the Cloudflare‑owned IP 172.66.47.83 (AS13335, United States). The domain is served through Cloudflare’s infrastructure, employing HSTS and HTTP/3, and presents a Google Trust Services / WE1 SSL certificate. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the site is explicitly listed as impersonating the MetaMask brand, with the scam type identified as a crypto‑scam. Reputation metrics are uniformly low: Gridinsoft assigns a trust score of 0 / 100, Scamadviser reports 41 / 100, and the domain appears on a single security blocklist.

VirusTotal analysis shows that 10 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion. The domain has already been blocked by PhishDestroy and currently returns HTTP 403, indicating that access is being denied or the site has been taken offline. Registration was performed through Cloudflare, Inc., using the nameservers stella.ns.cloudflare.com and jarred.ns.cloudflare.com, which are typical for Cloudflare‑hosted domains.

No additional public intelligence such as Google Safe Browsing, OTX, or detailed payload information is available, leaving the exact phishing content and victim acquisition methods unconfirmed. Defenders should add dash-metamaskio.pages.dev to DNS and URL filtering policies, monitor Cloudflare‑origin IP ranges for re‑use of the same host, and alert users of MetaMask‑related phishing attempts. Continuous intelligence gathering is advised to detect any re‑registration or resurrection of the domain, and incident response teams should be prepared to block related crypto‑drain vectors should they emerge.