io--metamask-login[.]pages[.]dev

Analysis of the domain io--metamask-login.pages.dev indicates a confirmed phishing infrastructure targeting MetaMask, a cryptocurrency wallet service. The domain, registered through Cloudflare, Inc., was flagged by security vendors and subsequently taken offline as of July 23, 2026. Infrastructure evidence reveals it resolved to the IP address 188.114.97.3, associated with Cloudflare's network (AS13335) in the United States. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare's standard configuration, though this does not mitigate the domain's malicious intent.

The domain appears on at least one security blocklist, and 14 of 95 vendors on VirusTotal flagged it as malicious, corroborating its classification as a crypto scam. The HTTP status returned a 403 Forbidden response at the time of investigation, and the page title explicitly states 'Suspected phishing site | Cloudflare,' further confirming its detection and mitigation by the hosting provider. Technologies detected include HSTS, Cloudflare CDN, and HTTP/3, typical of modern phishing kits leveraging legitimate infrastructure to evade initial scrutiny. Nameservers (rosa.ns.cloudflare.com and yadiel.ns.cloudflare.com) and the subdomain structure (pages.dev) suggest the use of Cloudflare Pages, a platform occasionally exploited for rapid deployment of phishing sites.

While the exact content of the site remains unanalyzed, the available metadata—including the brand target (MetaMask) and scam type (crypto scam)—aligns with known tactics for credential harvesting or cryptocurrency theft. Defenders should treat this domain as compromised and ensure it is blocked at the network and endpoint levels. Further investigation into associated infrastructure, such as linked IPs or domains, may uncover additional threats.