motamsklognc[.]webflow[.]io

The domain motamsklognc.webflow.io was observed hosting a page titled "Metamask® Login - Simᑭlify Your Ethereum Experience," explicitly referencing the MetaMask brand. The page title, combined with the classification "Crypto Scam," indicates a brand‑impersonation attempt aimed at credential harvesting for cryptocurrency wallets. The site is presently offline, returning HTTP 404, and was taken down after being blocked by PhishDestroy. Infrastructure analysis shows the domain resolves to 104.18.36.248, an address owned by Cloudflare (AS13335) located in the United States. The domain leverages Cloudflare services, including HTTP/3, and presents a TLS certificate issued by Google Trust Services under the WE1 root, which is typical for legitimate Cloudflare‑hosted sites and does not mitigate the malicious intent.

Registration data reveal the domain was created on 08 May 2013 and was registered through MarkMonitor, Inc., a registrar often used for legitimate trademark owners, suggesting possible abuse of a long‑standing registration or a compromised account. DNS resolvers list journey.ns.cloudflare.com and lamar.ns.cloudflare.com as authoritative name servers, consistent with the hosting provider. VirusTotal scanning flagged the domain by 19 of 95 security vendors, indicating a consensus of malicious classification. The domain appears on a single security blocklist and has been explicitly listed by PhishDestroy, confirming that at least one commercial feed has identified it as a threat. No additional public threat‑intelligence feeds or Safe Browsing entries were provided.

Defenders should immediately block the domain at the network perimeter, add the associated IP address to deny lists, and monitor for any DNS queries to the listed name servers. Given the use of a reputable registrar and a valid TLS certificate, organizations should not rely on certificate legitimacy as an indicator of safety.