metamaskloio[.]webflow[.]io

On 23 July 2026, analysis of metamaskloio.webflow.io indicates the site is currently offline but retains indicators of a crypto‑related brand‑impersonation campaign targeting MetaMask users. The domain resolves to IP 172.64.151.8, which belongs to Cloudflare, Inc. (ASN 13335) and is located in the United States. The hosting environment reports Cloudflare services and HTTP/3 support, and the SSL certificate is issued by Google Trust Services under the WE1 profile, confirming a legitimate TLS termination. The page title returned by the server is “Metamask Login: The Crypto Wallet for Defi”, and the HTTP response code is 404, suggesting the malicious landing page has been removed or hidden.

Registration data shows the domain was created on 8 May 2013 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate brands, which may aid evasion. VirusTotal scans flagged the domain in 15 of 95 security vendors, and it appears on one external blocklist, indicating that multiple detection engines have observed malicious activity. PhishDestroy has already added the domain to its block list, confirming community‑wide mitigation. The infrastructure evidence points to a crypto scam that attempts to harvest MetaMask credentials, although the exact phishing kit or payload has not been captured.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation of the host, and update threat‑intel feeds with the observed indicators (domain name, IP address, SSL fingerprint, and page title). Because the site is presently offline, ongoing reconnaissance should focus on related subdomains or future re‑use of the same Cloudflare IP range. Organizations using MetaMask should educate users about unsolicited login prompts and enforce multi‑factor authentication where possible.