io-musk--org[.]pages[.]dev

Analysis of the domain io-musk--org.pages.dev confirms it as a high-risk phishing site targeting MetaMask users, designed to harvest wallet seed phrases. The domain was registered on February 21, 2026, and is hosted on Cloudflare infrastructure, resolving to the IP address 188.114.97.3 (AS13335, United States). The page title, 'MetaMask Login™ — Secure Access, Recovery & Best Practices,' directly aligns with the identified scam type: wallet/seed phishing, as noted in available threat intelligence. Infrastructure analysis reveals the use of Cloudflare nameservers (davina.ns.cloudflare.com and alfred.ns.cloudflare.com), along with security technologies such as HSTS and HTTP/3. The domain is currently offline, returning an HTTP 403 status, which may indicate takedown efforts or temporary suspension.

Google Safe Browsing has flagged the site for social engineering, and it appears on at least one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites leveraging Cloudflare. VirusTotal reports that 11 out of 93 security vendors have flagged this domain, providing further evidence of its malicious nature. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification.

While the exact content of the phishing page remains unanalyzed, the combination of the page title, scam type, and detection by multiple security vendors confirms its intent to impersonate MetaMask for credential theft. Defenders should treat this domain as confirmed malicious and ensure it is blocked at the network and endpoint levels. Organizations should also monitor for related domains leveraging similar naming conventions or Cloudflare Pages infrastructure, as these may indicate additional phishing campaigns.