io-mtamask-logn[.]pages[.]dev

Analysis of io-mtamask-logn.pages.dev indicates a high‑risk credential‑phishing operation that has been taken offline. The domain was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.97.3, situated in the United States under ASN 13335. DNS is served by lorna.ns.cloudflare.com and boyd.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. An HTTPS connection is presented with a Google Trust Services / WE1 certificate, while the site enforces HSTS and supports HTTP/3, both typical of Cloudflare‑hosted services. The HTTP response returned a 403 status code and the page title reported by the scanner reads “Suspected phishing site | Cloudflare”, which aligns with the classification as a credential‑phishing page.

Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100. Google Safe Browsing flags the domain for social‑engineering content, and it appears on one security blocklist. VirusTotal analysis shows that 14 of 93 scanning engines flagged the domain, reinforcing the malicious assessment. The site has been listed by PhishDestroy as a blocked credential‑phishing instance.

Evidence confirms the domain’s malicious intent, but the offline status prevents real‑time content inspection, leaving the exact phishing landing page unknown. Defenders should continue to block the domain at network perimeter, update URL filtering lists, and monitor for any re‑activation of the host. Because the domain relies on Cloudflare’s shared IP space, additional scrutiny of other subdomains on the same IP may be warranted. Ongoing intelligence collection is advised to capture any future payloads or redirects should the site be reinstated.