mttmussklogeen[.]webflow[.]io

This domain, mttmussklogeen.webflow.io, presents an elevated-risk credential harvesting threat targeting users of the MetaMask cryptocurrency wallet. The site mimics the official MetaMask login interface, displaying the page title 'MetaMask Login: Your Key to the Decentralized World' to deceive visitors into entering their wallet credentials or recovery phrases. Such impersonation is commonly used to facilitate unauthorized access to digital assets, enabling attackers to drain funds from compromised accounts. The domain does not host legitimate services and should be treated as malicious infrastructure designed for cryptocurrency theft. Analysis indicates the domain was created on May 8, 2013, under the registrar MarkMonitor, Inc., though it is currently being misused for fraudulent purposes. It resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of malicious activity. Detection data from VirusTotal shows that 13 out of 95 security vendors have flagged this domain as malicious, while it also appears on one security blocklist. The SSL certificate is issued by Google Trust Services, which does not inherently validate the legitimacy of the site’s content or intent. These indicators collectively confirm the domain’s involvement in a brand impersonation campaign targeting MetaMask users. Users who have visited mttmussklogeen.webflow.io or entered any sensitive information on the site should take immediate action to secure their accounts. First, revoke any active sessions or connected applications linked to the MetaMask wallet. Next, transfer remaining funds to a new, secure wallet with a fresh seed phrase. Enable two-factor authentication if available and monitor the original wallet for unauthorized transactions. If credentials or recovery phrases were exposed, assume the account is compromised and avoid further interaction with it. Report the incident to relevant security teams and consider notifying blockchain analytics platforms to track potential fund movements.