mitamnnklognu[.]webflow[.]io

Analysis indicates that mitamnnklognu.webflow.io is a brand‑impersonation site targeting MetaMask users. The domain resolves to IP 104.18.36.248, which belongs to AS13335 Cloudflare, Inc., and the hosting location is identified as the United States. DNS resolution uses Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming that the infrastructure is fully leveraged through Cloudflare’s edge network and HTTP/3 support. The site presents a page title of “MetaMask | Login - A crypto wallet & gateway to blockchain,” directly referencing the MetaMask brand and suggesting a credential‑harvesting intent consistent with the listed scam type of a crypto scam.

VirusTotal has recorded 13 detections out of 95 scanned engines, indicating that multiple security vendors flag the domain as malicious. The domain appears on at least one public blocklist and has been actively blocked by PhishDestroy, reinforcing the consensus that the site is being used for phishing or credential theft. The SSL certificate is issued by Google Trust Services under the WE1 authority, which is typical for legitimate Cloudflare‑protected sites, but the presence of a valid certificate does not mitigate the impersonation risk. An HTTP 404 response was observed, and the current status is marked as offline, suggesting that the site may have been taken down or is temporarily unavailable.

Registration data shows the domain was created on May 08 2013 and is managed through MarkMonitor, Inc., a registrar commonly used by high‑value brands for protective registration services. This long‑standing registration date, coupled with recent malicious activity, points to either a compromised legitimate domain or a deliberately registered look‑alike that has been repurposed for phishing. No additional evidence of a phishing kit, malicious payload, or secondary infrastructure has been disclosed.