nav-metaamsk--run[.]pages[.]dev

Analysis of the domain nav-metaamsk--run.pages.dev indicates it is being used for a high‑risk phishing campaign targeting MetaMask users. The domain was registered on 8 June 2026 and is hosted on Cloudflare Pages, a static‑site hosting service that assigns shared infrastructure and automatic TLS termination. The short lifespan and recent creation date are consistent with a rapid‑deployment malicious site. The domain appears on three public blocklists and has been explicitly blocked by the anti‑phishing feeds PhishDestroy, MetaMask, and SEAL, confirming that multiple security vendors have observed malicious activity associated with it. VirusTotal scans show that 13 of 91 security engines flagged the domain, providing independent corroboration of its malicious nature.

No additional intelligence such as Safe Browsing verdicts, OTX identifiers, or detailed HTTP response codes is publicly disclosed at this time. Because Cloudflare Pages uses shared IP addresses, blocking at the IP level is unlikely to be effective, reinforcing the need for domain‑level controls. The naming pattern “nav‑metaamsk‑‑run” suggests an attempt to mimic legitimate MetaMask navigation URLs, and defenders should monitor for variants that reuse the “metaamsk” token. The lack of a publicly available page title or content analysis means the exact phishing vector cannot be confirmed, but the site is presumed capable of harvesting MetaMask credentials or initiating unauthorized wallet transactions.

Defenders should add the domain to URL filtering rules, enforce DNS‑level blocking, and monitor for any related sub‑domains or similarly structured Cloudflare Pages URLs. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture any changes in behavior. Organizations that rely on MetaMask for cryptocurrency transactions should alert users to the risk and advise verification of URLs before entering wallet credentials.