metamask-loginp[.]webflow[.]io

The domain metamask-loginp.webflow.io was observed as a brand‑impersonation site targeting MetaMask users. The site’s title, “MetaMask Login – A crypto wallet & gateway to blockchain apps,” directly references the MetaMask brand, confirming the intent to lure credential submissions. Registration data shows the domain was created on 25 February 2026 and is registered through MarkMonitor, Inc., a registrar commonly used for legitimate brand assets, indicating that the threat actor leveraged a reputable registrar to increase perceived legitimacy. DNS resolution points to the IP address 172.64.151.8, hosted by Cloudflare (AS13335) in the United States; the domain uses Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com and is served over HTTP/3 with an SSL certificate issued by Google Trust Services / WE1, providing a valid TLS chain that could deceive automated trust checks.

An HTTP request returns a 404 status, suggesting that the phishing page may have been removed or taken offline, which aligns with the reported “offline” status. At the time of analysis, VirusTotal recorded 14 detections out of 93 scanning engines, and the domain is listed on three public blocklists. It has been actively blocked by PhishDestroy, MetaMask’s own protection mechanisms, and the SEAL threat‑intelligence feed. These multiple independent detections reinforce the high‑risk classification.

The page’s metadata does not reveal additional content, and no further technical artifacts such as JavaScript payloads or additional sub‑domains have been disclosed, leaving the full operational profile uncertain. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any resurgence of the host under the same IP address or nameserver configuration, and ensure that MetaMask users are warned about the unauthorized login page.