home-metamusk-login[.]pages[.]dev

home-metamusk-login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare's network (AS13335) with the IP address 172.66.44.81 located in the United States. The domain resolves to a Cloudflare‑provided IP and uses Cloudflare‑managed DNS (dylan.ns.cloudflare.com, lily.ns.cloudflare.com). The site presented the page title “Suspected phishing site | Cloudflare” and returned HTTP 403, indicating that the content is no longer publicly reachable. Despite the current offline status, the domain appears on one security blocklist and has been actively blocked by PhishDestroy.

VirusTotal analysis shows that four of ninety‑three scanning engines flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The TLS certificate is issued by Google Trust Services under the WE1 leaf, confirming that HTTPS is enforced via HSTS and HTTP/3 support, typical of Cloudflare‑served sites. The evidence collectively points to a credential‑phishing operation, although the specific target brand or credential type has not been disclosed in the available data.

Defenders should continue to block the domain at the network perimeter, add the associated IP address to deny lists, and monitor for any re‑registration attempts or similar sub‑domains using the same Cloudflare name servers. Ongoing threat‑intel feeds should be consulted for updates, and any internal alerts that reference the domain or its IP should be investigated for potential exposure. Because the site is no longer serving content, remediation focuses on preventing future reuse and ensuring that endpoint security products remain aware of the historical flagging.