metamaskzllogin[.]webflow[.]io

This investigation concerns the domain metamaskzllogin.webflow.io, observed as a brand‑impersonation attempt targeting MetaMask. The domain was registered on 21 February 2026 through NameCheap, Inc. and resolves to the IP address 104.18.36.248, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The site is served behind Cloudflare and utilizes HTTP/3, presenting a TLS certificate issued by Google Trust Services under the “WE1” designation. When queried, the HTTP response returns a 404 status and the page title “404 - Page not found”, indicating that the malicious landing page is not currently accessible.

VirusTotal analysis shows that ten of ninety‑three scanning vendors flagged the domain, reflecting moderate detection confidence. The domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy service. Google Safe Browsing categorises the site as “social engineering”, and the overall threat vector is identified as a crypto‑related scam. The brand target is explicitly MetaMask, confirming that the actor attempted to lure victims by mimicking MetaMask login flows.

The current offline status suggests that the hosting provider or upstream mitigation has taken the site down, but the infrastructure components remain active and could be repurposed for future campaigns. Defenders should immediately add the domain and its resolving IP address to block lists, monitor for any re‑registration attempts, and enforce strict URL filtering for any subdomains of webflow.io that contain “metamask” patterns. Continuous observation of Cloudflare‑hosted assets associated with the same IP is also advised, as threat actors frequently rotate content while preserving the same network footprint. Because the page content is unavailable, further forensic analysis of any archived snapshots would be required to confirm the exact phishing payload and credential‑capture mechanisms.