metamsk-io-chrome[.]pages[.]dev

This domain, metamsk-io-chrome.pages.dev, is under investigation as a high-risk phishing site targeting MetaMask users. Registered through Cloudflare, Inc. on February 21, 2026, the domain resolves to IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335) in the United States. Analysis of its nameservers—virginia.ns.cloudflare.com and guss.ns.cloudflare.com—confirms Cloudflare as the DNS provider. The domain’s SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare’s standard configuration. At the time of assessment, the domain returned an HTTP 403 status, with Cloudflare’s default page title 'Suspected phishing site | Cloudflare,' indicating internal flagging by the provider.

Detection metrics reveal limited but significant scrutiny: 15 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on at least one security blocklist. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. Google Safe Browsing explicitly categorizes the domain under 'social engineering,' a designation typically applied to phishing or deceptive credential-harvesting pages. The domain’s use of HSTS and HTTP/3 further suggests an attempt to mimic legitimate security practices, though these technologies are not exclusive to malicious actors. No evidence confirms the exact content or functionality of the phishing kit deployed, as the domain is currently offline.

However, the naming convention—combining 'metamsk' (a common misspelling of MetaMask) with 'chrome'—strongly implies an intent to deceive users into disclosing cryptocurrency wallet credentials. Defenders should treat this domain as part of a credential-phishing campaign targeting MetaMask users, particularly those accessing the site via browser extensions or web interfaces. Network-level blocking of the IP 188.114.97.3 and monitoring for related subdomains under *.pages.dev are recommended.