matamaskccryptologin[.]webflow[.]io

This domain, matamaskccryptologin.webflow.io, is assessed as a high-risk brand impersonation threat targeting MetaMask users. The infrastructure was designed to deceive victims into submitting cryptocurrency wallet credentials, likely leading to unauthorized access and asset theft. Analysis indicates the site employed convincing MetaMask branding, login interfaces, and error messages to manipulate users into disclosing sensitive authentication details. Infrastructure analysis reveals the domain was hosted on Webflow and resolved to IP address 172.64.151.8, associated with AS13335 (Cloudflare, Inc.) in the United States. The domain appears on three security blocklists and is flagged by Google Safe Browsing as phishing. VirusTotal reports 17 out of 95 security vendors detecting the domain as malicious. The page titles observed—metamask login, metamask sign in, metamask login error—further confirm its intent to mimic legitimate MetaMask authentication flows. No creation date is available, but the domain was actively blocked by multiple threat intelligence feeds, including those maintained by the targeted brand. Mitigation requires immediate user awareness and technical controls. Organizations should ensure endpoint protection systems are configured to block domains flagged by at least three independent threat intelligence sources. Users who may have interacted with the domain should revoke active sessions, rotate credentials, and monitor wallet activity for unauthorized transactions. Network-level blocking of the IP 172.64.151.8 and domains registered through Webflow exhibiting similar naming patterns is recommended. Given the offline status, continued monitoring for re-emergence under altered infrastructure is advised.