memasknflogin[.]webflow[.]io

Analysis of memasknflogin.webflow.io indicates a confirmed brand‑impersonation campaign targeting MetaMask users. The site was registered through MarkMonitor, Inc. on May 08, 2013 and resolves to the Cloudflare IP address 172.64.151.8, belonging to AS13335 Cloudflare, Inc. in the United States. The domain is served via Cloudflare’s infrastructure, employing HTTP/3 and presenting a Google Trust Services / WE1 SSL certificate, which may lend an appearance of legitimacy. The page title observed during investigation reads "MetaMask® Łøgin: Connect to the Decentralized Web," directly referencing the MetaMask brand and suggesting a credential‑collection intent.

Although the current HTTP response is 404 and the site is listed as offline, historical evidence shows it was active as a crypto‑scam landing page. Security telemetry reports that 15 of 95 VirusTotal scanners flagged the domain as malicious, and the domain appears on a single security blocklist. It has also been blocked by PhishDestroy, confirming that at least one external mitigation service recognized it as a threat. The combination of brand impersonation, a crypto‑scam classification, and the presence of a valid SSL certificate underscores the difficulty of automated detection based solely on certificate validity.

Defenders should proactively block the domain and its resolved IP address in network filters, continue to monitor the registrar MarkMonitor for any re‑registration attempts, and enforce URL filtering policies that flag any webflow.io subdomains presenting MetaMask‑related titles. User education campaigns should remind users that legitimate MetaMask interactions occur only through official domains and that unexpected login prompts on third‑party sites are likely malicious. Continuous threat‑intel feeds should be consulted for any re‑appearance of similar impersonation patterns.