mettamaskccrypto-signin[.]webflow[.]io

This domain, mettamaskccrypto-signin.webflow.io, is assessed as a high-risk credential harvesting infrastructure specifically designed to impersonate Google authentication portals. Analysis indicates the site was engineered to capture user credentials through deceptive login interfaces, leveraging brand impersonation techniques to exploit trust in the targeted service. The threat type aligns with credential phishing campaigns, where attackers mimic legitimate authentication flows to harvest sensitive account information. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered through NameCheap, Inc. on February 21, 2026, and resolves to IP address 104.18.36.248, hosted on Cloudflare's network (AS13335). Security vendors flagged the domain in 19 out of 95 VirusTotal scans, while it appears on three independent security blocklists. The site was blocked by PhishDestroy, MetaMask, and SEAL, and Google Safe Browsing explicitly labels it as phishing. The SSL certificate, issued by Google Trust Services (WE1), further suggests an attempt to mimic legitimate encryption standards. Despite the current 404 status, historical evidence confirms the domain previously hosted active phishing content. Mitigation requires immediate action from both end users and security teams. Users who accessed the domain should invalidate any entered credentials and enable multi-factor authentication on all associated accounts. Security teams should add the domain and its resolving IP (104.18.36.248) to blocklists, while monitoring for related infrastructure using the creation date (February 21, 2026) and registrar (NameCheap) as pivot points. Network-level protections should be implemented to prevent access to domains with similar naming patterns, particularly those combining brand names with cryptographic terms. Post-incident analysis should include a review of authentication logs for any successful credential submissions during the domain's active period.