mttasrrkkluugen[.]webflow[.]io

Analysis of mttasrrkkluugen.webflow.io shows a confirmed credential‑harvesting site that mimics MetaMask. The domain, registered through MarkMonitor, Inc. on 08 May 2013, resolves to the IPv6 address 2606:4700:4400::6812:24f8, which is owned by Cloudflare (AS13335) and located in the United States. The hosting infrastructure advertises Cloudflare services with HTTP/3 enabled, and the TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a legitimate‑looking HTTPS connection. A request to the site returns HTTP 404, and the page title captured during scanning reads “𝓜𝓮𝓽𝓪𝓶𝓪𝓼𝓴 𝓛𝓸𝓰𝓲𝓷 – 𝓨𝓸𝓾𝓻 𝓴𝓮𝔂 𝓽𝓸 𝓫𝓵𝓸𝓬𝓴𝓬𝓱𝓪𝓲𝓷”, directly referencing the MetaMask brand and suggesting a crypto‑wallet login funnel.

The site appears on a single security blocklist and has been flagged by 13 of 95 VirusTotal scanners, demonstrating moderate detection confidence. PhishDestroy has already taken the domain offline, and its current status is listed as “taken offline”. Nameserver records point to lamar.ns.cloudflare.com and journey.ns.cloudflare.com, confirming the Cloudflare DNS service. Uncertainty remains regarding the specific phishing kit used, as no additional payload or code artifacts have been disclosed.

The 404 response may indicate that the malicious page was removed prior to capture, limiting forensic detail. Defenders should continue to block the IPv6 address and associated hostnames, monitor for any re‑registration of the domain or similar subdomains on the same hosting provider, and update URL filtering rules to include the observed page title pattern. Organizations that rely on MetaMask should educate users to verify the exact URL and TLS certificate of the official extension, and consider enabling multi‑factor authentication for wallet access. Incident response teams should collect any available logs that reference connections to this address for correlation with credential‑theft activity.