metamasklogini[.]webflow[.]io

This domain, metamasklogini.webflow.io, is flagged as a high-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet and blockchain gateway. The page title, "MetaMask Login-#Crypto wallet & Gateway TØ Blockchain app," directly mimics official MetaMask branding to deceive users into entering credentials or private keys. No explicit drainer kit signatures were identified in the available intelligence, but the domain’s structure and content align with credential harvesting tactics commonly employed in cryptocurrency phishing campaigns.

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.64.151.8, hosted on Cloudflare infrastructure (AS13335). It was registered through NameCheap, Inc. on February 21, 2026, with an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, and it appears on three security blocklists. The domain was not listed in Google Safe Browsing at the time of analysis, though it has been blocked by multiple independent threat intelligence feeds.

As of the latest assessment, metamasklogini.webflow.io has been taken offline, likely in response to takedown requests or automated abuse detection mechanisms. Despite its current inactive status, residual risk persists due to potential cached DNS records, phishing kits distributed via other channels, or re-registration under a similar domain. Users who interacted with this domain should assume credential exposure, revoke active sessions, and monitor associated accounts for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address to prevent future access attempts.