metmaskelogin[.]webflow[.]io

Analysis as of August 02, 2026 indicates that the domain metmaskelogin.webflow.io remains active and is associated with credential phishing. The domain resolves to the IP address 104.18.36.248, which belongs to the Webflow hosting platform. Registration information shows the domain was provisioned through Webflow, Inc., a legitimate site‑builder service, but no nameserver records were returned in the query. The site has been listed on a single security blocklist and is actively blocked by PhishDestroy, suggesting that at least one external mitigation service has identified malicious use.

VirusTotal reports that the domain was scanned by 91 antivirus and URL‑reputation vendors; none of the scanners raised a detection at the time of analysis. While the absence of detections does not constitute a safety guarantee, it confirms that the domain has not yet triggered automated signatures in the examined feeds. No public SSL certificate details, HTTP response codes, or page‑title metadata have been disclosed, limiting visibility into the site’s surface.

Consequently, defenders should continue to treat any traffic to metmaskelogin.webflow.io as suspicious, especially any attempts to submit credentials. Recommended actions include enforcing outbound filtering for the domain, monitoring DNS queries for the associated IP address, and updating internal blocklists to include the domain. Because the infrastructure leverages a reputable hosting provider, threat actors may rely on the provider’s reputation to evade basic reputation checks, reinforcing the need for layered detection such as URL‑reputation services and user‑education on credential‑phishing attempts.