official-metmask-io[.]pages[.]dev

official-metmask-io.pages.dev was registered on June 08, 2026 and is hosted on Cloudflare Pages. VirusTotal records show that 11 out of 91 scanned engines have flagged the domain as malicious, indicating a consensus among security vendors that the site is being used for phishing. The domain appears on three public blocklists and is actively listed by PhishDestroy, MetaMask, and SEAL, confirming that downstream protections are already aware of its activity.

The threat is classified as generic phishing with a high risk rating and the status remains active. At present no additional technical artefacts such as SSL certificate details, page title, or content snapshots have been released, so the exact payload and lure employed by the site cannot be described. The primary uncertainty lies in the absence of observed network traffic or victim reports, which limits attribution of the specific campaign infrastructure beyond the Cloudflare Pages front‑end.

Defenders should immediately add official-metmask-io.pages.dev to URL filtering and DNS block policies, ensure that any email gateway that references the domain is set to quarantine, and monitor for related Cloudflare‑hosted subdomains that share the same registrar footprint. Because Cloudflare Pages can serve many unrelated sites from the same edge, correlation with other suspicious domains created around the same date may help uncover additional malicious actors. Continuous re‑scanning with VirusTotal and periodic checks against blocklist updates are recommended to capture any changes in detection scores.