metamsk-io-extension[.]pages[.]dev

Analysis of the domain metamsk-io-extension.pages.dev (created 21 February 2026) shows that it is presently taken offline (HTTP 403) but historical indicators classify it as a high‑risk credential phishing site. Google Safe Browsing lists the domain under social engineering, and fifteen of ninety‑three VirusTotal scanners have flagged it as malicious. The page title returned from the host is "Suspected phishing site | Cloudflare," confirming that the page itself was presented as a phishing warning.

The SSL certificate is issued by Google Trust Services under the WE1 identifier, which is typical for Cloudflare‑protected sites, and the domain uses HSTS and HTTP/3 over Cloudflare’s network (ASN 13335, United States). Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on at least one public blocklist, with PhishDestroy actively blocking it. The domain resolves to IP address 172.66.47.176 and is served by Cloudflare nameservers tiffany.ns.cloudflare.com and milan.ns.cloudflare.com, indicating that the attacker leveraged Cloudflare’s free hosting to obscure the true backend.

While the site is no longer reachable, the combination of credential‑phishing classification, multiple vendor detections, and a zero trust score suggests a deliberate attempt to harvest user credentials. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or similar sub‑domains, and enforce user awareness training that warns against unexpected login prompts. Ongoing threat‑intel feeds should be consulted for any resurgence of the domain or related indicators.