mimtmasklloogin[.]webflow[.]io

This domain, mimtmasklloogin.webflow.io, is flagged as a high-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. The site mimics the official MetaMask onboarding process, as indicated by the page title 'Getting started with MetaMask – MetaMask,' designed to deceive users into disclosing sensitive credentials or wallet recovery phrases. No specific drainer kit signatures were identified in initial analysis, but the domain exhibits classic traits of credential harvesting infrastructure commonly used in cryptocurrency phishing campaigns.

Technical indicators confirm the malicious nature of this domain. VirusTotal reports 18 out of 95 security vendors detecting the domain as malicious, with registration through NameCheap, Inc. on February 21, 2026. The domain resolves to IP address 172.64.151.8, hosted on Cloudflare infrastructure (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. The domain appears on three security blocklists, including those maintained by cryptocurrency security entities, and is blocked by at least three independent threat intelligence feeds.

As of the latest verification, mimtmasklloogin.webflow.io has been taken offline, likely due to enforcement actions by the hosting provider or domain registrar. However, residual risk remains for users who may have interacted with the site prior to its takedown. Affected individuals should immediately revoke any active sessions, rotate credentials, and monitor associated wallet addresses for unauthorized transactions. Organizations maintaining blocklists are advised to retain this domain in their denylists for at least 12 months due to the high likelihood of re-emergence under similar infrastructure. Users are cautioned against engaging with any domains impersonating MetaMask, particularly those hosted on webflow.io or other platform-as-a-service providers.