io-musk-or[.]pages[.]dev

The domain io-musk-or.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and its authoritative name servers are davina.ns.cloudflare.com and alfred.ns.cloudflare.com. DNS resolution points to IP 172.66.44.156, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 trust anchor, indicating a valid HTTPS handshake despite the malicious intent. An HTTP request to the host returns a 403 status code, preventing direct content retrieval, but the page title observed in prior scans reads "MetaMask Login™ — Secure Access, Recovery & Best Practices," clearly aligning with the wallet/seed phishing kit targeting the MetaMask brand.

VirusTotal records show that 11 of 95 security vendors have flagged the domain, and Google Safe Browsing classifies it as a social engineering threat. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, reinforcing its malicious reputation. The infrastructure leverages Cloudflare's edge services, with HSTS and HTTP/3 enabled, which may aid in evading simple network‑level filters.

While the site is currently offline, the observable indicators—registration details, hosting IP, TLS certificate, vendor detections, and brand‑specific page title—provide sufficient confidence to label the domain as a confirmed MetaMask impersonation scam. Defenders should add the domain and its resolved IP to blocklists, monitor for any re‑hosting activity, and ensure endpoint security solutions reference the associated Google Safe Browsing and VirusTotal signatures. Continuous observation of Cloudflare‑hosted malicious domains is recommended, as the provider's shared infrastructure can be reused for future campaigns.