metamask-io-logn[.]pages[.]dev

metamask-io-logn.pages.dev poses a specific threat of brand impersonation, targeting users of the popular cryptocurrency wallet, MetaMask. If visited, this domain can trick users into divulging sensitive information such as login credentials, private keys, or other personal data, leading to potential financial losses and identity theft.

Analysis indicates that the domain was flagged by 15 out of 95 security vendors on VirusTotal, suggesting a high level of suspicion among security professionals. The domain is registered through Cloudflare, Inc., and was created on October 28, 2025. It resolves to the IP address 172.66.44.206, which is located in the United States and is part of the Cloudflare network (AS13335). The site has been blocked by PhishDestroy and is flagged as a phishing site by Google Safe Browsing. Additionally, it appears on one known security blocklist. The SSL certificate is issued by Google Trust Services / WE1, which can lend a false sense of security to unsuspecting visitors.

If users have visited metamask-io-logn.pages.dev, they should immediately check their MetaMask accounts for any unauthorized activity. It is recommended to change passwords and private keys, and to monitor for any unusual transactions or account access. Users should also run a comprehensive security scan on their devices to ensure no malicious software was downloaded. Reporting the incident to MetaMask support and informing their financial institutions can help mitigate potential damage from this brand impersonation attempt.