metamask-io-eng-loggin[.]pages[.]dev

Analysis of the domain metamask-io-eng-loggin.pages.dev shows a clear pattern of brand impersonation targeting MetaMask. The site was registered on October 30, 2025 through Cloudflare, Inc., and the authoritative nameservers heather.ns.cloudflare.com and tosana.ns.cloudflare.com resolve the domain to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The hosting infrastructure presents HSTS, Cloudflare services, and HTTP/3 support, and the TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint. The HTTP response currently returned is 403, and the page title presented by the server is "Suspected phishing site | Cloudflare," a generic placeholder often used when the underlying content has been removed or blocked.

The domain is classified as a crypto scam and appears on a single security blocklist, with PhishDestroy confirming its removal from active service. VirusTotal analysis records ten of ninety‑three scanners flagging the domain, reinforcing the malicious assessment. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence level in benign behavior.

While the exact payload or credential‑harvesting page cannot be observed due to the offline status, the combination of brand impersonation, crypto‑focused labeling, low trust score, multiple vendor detections, and blocklist inclusion provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter, update URL filtering policies to include the observed IP and host, and monitor for any re‑registration attempts under related subdomains. Further investigation may focus on any residual DNS records or archival captures that could reveal the phishing content previously served.