mtamsseck[.]webflow[.]io

This domain, mtamsseck.webflow.io, is flagged for brand impersonation targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site was designed to deceive users into entering sensitive wallet credentials, including private keys or recovery phrases, by mimicking the legitimate MetaMask interface. The page title 'mtamsseck' suggests an attempt to obscure its malicious intent while leveraging a seemingly benign subdomain structure to evade casual detection. Such credential harvesting poses a direct financial risk to users, enabling attackers to drain digital assets from compromised wallets without authorization. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on May 08, 2013, though the subdomain itself appears to have been repurposed for malicious activity. It resolves to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin servers and leverage Cloudflare’s SSL termination (certificate issued by Google Trust Services / WE1). The domain is currently flagged by 18 out of 95 security vendors on VirusTotal and appears on two independent security blocklists. Despite its creation date, the domain’s recent malicious activity aligns with a pattern of repurposed or compromised subdomains used for short-term phishing campaigns. Users who visited mtamsseck.webflow.io or entered credentials on the site should immediately revoke access to any linked wallets and transfer remaining assets to a new, secure wallet. All passwords, recovery phrases, and private keys associated with the compromised account must be considered exposed and invalidated. Monitor transaction histories for unauthorized activity and enable multi-factor authentication on all related accounts. If financial loss occurred, report the incident to relevant authorities and provide all technical indicators, including the domain, IP address 172.64.151.8, and SSL certificate details, to aid in further investigation. The domain is currently offline, but users should remain vigilant for similar impersonation attempts using other subdomains or newly registered domains.