metsccsklogin[.]webflow[.]io

This domain is flagged for elevated risk due to brand impersonation targeting MetaMask, a widely used cryptocurrency wallet. The site mimics official MetaMask login pages, likely aiming to harvest credentials or distribute malicious extensions under the guise of legitimate software. Such impersonation poses a significant threat to users who may unknowingly expose sensitive wallet access or install compromised applications, leading to potential financial loss. Infrastructure analysis reveals multiple indicators of compromise. The domain metsccsklogin.webflow.io was created on May 08, 2013, and is registered through MarkMonitor, Inc., though its current operational status is offline. It resolves to the IP address 172.64.151.8, associated with Cloudflare, Inc. (AS13335). Security vendors on VirusTotal flagged the domain, with 17 out of 95 detecting malicious activity. The domain appears on one security blocklist, specifically PhishDestroy, and its SSL certificate is issued by Google Trust Services under the identifier WE1. The page title, 'Metamask Login | MetaMask Wallet | Metamask Extension | Download Blockchain Wallet App,' closely mirrors legitimate MetaMask branding, reinforcing the impersonation threat. To mitigate risks associated with this brand impersonation, users should verify domain authenticity before entering credentials or downloading software. Official MetaMask resources should be accessed exclusively through verified channels, such as the project’s official website or trusted app stores. Organizations should update blocklists to include this domain and monitor for similar impersonation attempts targeting cryptocurrency platforms. If credentials were entered on this site, immediate password resets and wallet security reviews are recommended. Additionally, enabling multi-factor authentication and reviewing installed browser extensions for unauthorized additions can reduce exposure to such threats.