mitasmskloginz[.]webflow[.]io

This domain is flagged as an elevated-risk credential harvesting site specializing in brand impersonation of MetaMask, a cryptocurrency wallet service. Analysis indicates the page titled 'Getting Started – MetaMask* Login' is designed to deceive users into submitting sensitive authentication details, including private keys or recovery phrases, under the pretense of a legitimate login portal. The threat type aligns with targeted financial fraud, where compromised credentials enable unauthorized access to digital assets. Infrastructure analysis reveals the domain mitasmskloginz.webflow.io was registered through MarkMonitor, Inc., a registrar commonly associated with legitimate enterprises, which may initially obscure its malicious intent. The domain resolves to IP address 104.18.36.248, hosted on AS13335 (Cloudflare, Inc.) in the United States, leveraging Cloudflare’s infrastructure to mask origin servers. Created on May 8, 2013, the domain’s age contrasts with its recent malicious activity, suggesting potential compromise or repurposing. The SSL certificate issued by Google Trust Services (WE1) adds a superficial layer of legitimacy. Detection metrics show 16 out of 95 security vendors on VirusTotal flagged the domain as malicious, while two blocklists—PhishDestroy and PhishingDB—have explicitly listed it. The page title, 'Getting Started – MetaMask* Login,' directly mimics MetaMask’s official onboarding language, reinforcing the impersonation tactic. Mitigation against this threat requires user-level and organizational safeguards. Users should verify domain authenticity by cross-referencing URLs with MetaMask’s official documentation or support channels before entering credentials. Browser-based security extensions that block known phishing domains can provide an additional layer of protection. Organizations managing cryptocurrency services should implement domain monitoring to detect impersonation attempts, particularly those using subdomains of legitimate platforms like webflow.io. Network-level defenses, such as DNS filtering or IP reputation checks, can preemptively block access to confirmed malicious endpoints. Given the domain’s current offline status, continuous monitoring for reactivation or similar variants is recommended, as threat actors frequently retool infrastructure to evade detection.