mthiamsklogning[.]webflow[.]io

This report details a fraudulent website impersonating the MetaMask cryptocurrency wallet. The site, titled "Metamask® login - Metamask® Extension," presents itself as a legitimate login portal for the MetaMask browser extension. The primary threat is credential harvesting, where users attempting to log in with their wallet seed phrases or passwords would have their information stolen, leading to the loss of cryptocurrency assets.

Technical analysis confirms the malicious nature of the site. VirusTotal flagged the domain with 13 detections out of 95 security vendors, indicating broad consensus on its threat status. It was specifically flagged by ChainPatrol, alphaMountain.ai, BitDefender, CRDF, and CyRadar. The domain is registered with MarkMonitor, Inc., and was created on 2013-05-08, though the current fraudulent content is recent. The IP address 104.18.36.248 is hosted in the United States by Cloudflare, Inc. (AS13335), and the site uses an SSL certificate from Google Trust Services / WE1.

The site was confirmed to be DOWN/OFFLINE at the time of analysis, rendering the immediate threat inactive. However, the risk level is assessed as High due to the nature of the scam (cryptocurrency theft) and the specific impersonation of a widely-used brand. The domain remains registered and could be reactivated with similar malicious content at any time.