metamsk-logn[.]pages[.]dev

This threat report details a credential phishing site hosted at metamsk-logn.pages.dev. The page title is "Suspected phishing site | Cloudflare," indicating the site was blocked as a known threat. The site impersonates the MetaMask cryptocurrency wallet brand to harvest user login credentials. The threat is credential theft, where victims entering their wallet details on this fraudulent site risk having their accounts compromised and assets stolen.

Technical evidence confirms the malicious nature of this site. VirusTotal reports 16 detections out of 95 security vendors. The domain was created on 2025-10-28, registered through Cloudflare, Inc., and hosted on IP address 172.66.47.40 in the United States, assigned to AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1. The domain uses nameservers buck.ns.cloudflare.com and vita.ns.cloudflare.com. It is flagged by blocklists from ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, and Chong Lua Dao.

The site is currently offline and inaccessible. The GridinSoft trust rating is 0 out of 100, and the DOM risk score is 78, indicating a high risk. Given the confirmed phishing activity and multiple vendor detections, this domain poses a significant threat to users and should be blocked.