metamaskio-login[.]pages[.]dev

On 23 July 2026, the domain metamaskio-login.pages.dev was observed as part of a high‑risk brand‑impersonation campaign targeting MetaMask users. The site was provisioned through Cloudflare, Inc., with authoritative nameservers aria.ns.cloudflare.com and rocco.ns.cloudflare.com, and resolves to the IP address 172.66.44.140, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint, while HTTP/3 and HSTS are advertised, suggesting modern transport security. The HTTP response returned a 403 status code and the page title displayed “Suspected phishing site | Cloudflare,” confirming that the content has been flagged by the hosting provider.

VirusTotal analysis recorded 13 positive detections out of 93 scanned scanners, and Google Safe Browsing classified the URL as social‑engineering, reinforcing the malicious intent. Independent security aggregators listed the domain on a single blocklist, and PhishDestroy reported the site as taken offline. The Gridinsoft trust score of 0 / 100 further reflects a lack of legitimacy. The domain was registered on 21 February 2026, and the only publicly visible technology fingerprint includes Cloudflare services and HTTP/3 support.

The intelligence indicates a crypto‑scam vector that leverages MetaMask brand impersonation, yet no additional payload details or post‑compromise behavior have been disclosed. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the host under alternative subdomains, and incorporate the observed indicators—IP 172.66.44.140, the Cloudflare nameservers, the specific TLS certificate chain, and the 13 VirusTotal detections—into threat‑intel feeds. Ongoing observation is advised to capture any future re‑hosting attempts that may reuse the same infrastructure.