mettamasklogiiann[.]webflow[.]io

This domain, mettamasklogiiann.webflow.io, poses a brand impersonation threat specifically targeting MetaMask users. Analysis indicates the site is designed to replicate the official MetaMask login interface, tricking users into entering sensitive credentials such as wallet seed phrases or private keys. The fraudulent page title, 'metamask login | metamask | Blockchain | MetaMask® Wallets,' closely mirrors legitimate branding to deceive visitors into believing they are accessing an authentic service. Such impersonation schemes are commonly used to facilitate unauthorized access to cryptocurrency wallets, leading to asset theft or further exploitation. Infrastructure analysis reveals multiple indicators of malicious intent. The domain has been flagged by 18 out of 95 security vendors on VirusTotal, demonstrating a significant level of detection across the security community. It appears on two security blocklists, including PhishDestroy and PhishingDB, further confirming its classification as a phishing resource. Registered through MarkMonitor, Inc. on May 08, 2013, the domain leverages a seemingly legitimate registration history to evade initial suspicion. However, its hosting on Cloudflare infrastructure (AS13335) and resolution to IP address 104.18.36.248 align with patterns observed in other phishing campaigns, where content delivery networks are exploited to obscure the true origin of malicious activity. Users who visited mettamasklogiiann.webflow.io should take immediate action to mitigate potential risks. If any credentials or seed phrases were entered on the site, it is critical to transfer assets to a new, secure wallet and revoke any connected sessions or authorizations. Monitor all linked accounts for unauthorized transactions and enable additional security measures, such as multi-factor authentication, where available. Given the domain's elevated risk status and confirmed offline status, users should remain vigilant for similar impersonation attempts and verify the authenticity of any MetaMask-related communications or login pages before interacting with them.