metammaklogio[.]webflow[.]io

This domain, metammaklogio.webflow.io, is identified as a brand impersonation threat targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the site presents a fraudulent login interface under the guise of MetaMask, likely designed to harvest user credentials or facilitate unauthorized transactions. The domain is currently offline, but prior activity aligns with credential phishing and crypto-related fraud. Infrastructure analysis reveals the domain was flagged by 14 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. It is hosted on IP address 104.18.36.248, associated with AS13335 (Cloudflare, Inc.), and employs an SSL certificate issued by Google Trust Services (WE1). The domain was registered through MarkMonitor, Inc., on May 8, 2013, though the specific subdomain (metammaklogio.webflow.io) appears to have been recently repurposed for malicious activity. It appears on two security blocklists: PhishDestroy and PhishingDB. The page title, 'Getting started with MetaMask - Metamask® login,' further confirms the intent to deceive users by mimicking official MetaMask branding. The domain is currently offline, but organizations and users are advised to treat any prior or future interactions with it as high-risk. Network administrators should ensure the domain and its associated IP (104.18.36.248) are blocked at the perimeter. End-users who may have accessed the site should rotate credentials for MetaMask or any other services where the same login details were used. Monitoring for unauthorized transactions or account access is strongly recommended. Given the domain's history and blocklist presence, any resurgence of activity should be treated as a critical security event.