mettaamsklogine[.]webflow[.]io

On July 23, 2026, analysis of the domain mettaamsklogine.webflow.io was completed. The domain was originally registered on May 08, 2013 and is hosted behind Cloudflare’s network (AS13335, United States). DNS resolution points to the address 104.18.36.248, and the authoritative name servers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The site was observed to serve an SSL certificate issued by Google Trust Services under the WE1 name, indicating a valid TLS handshake.

When accessed, the HTTP response code was 404, and the page title returned by the server is “Metamask Login - Your key to blockchain”, which aligns with the declared brand impersonation of MetaMask. VirusTotal scans show that fifteen of ninety‑five security vendors flagged the domain, and the domain is currently listed on a single security blocklist, where it has been blocked by PhishDestroy. The observed technology stack includes Cloudflare services and HTTP/3 support. Registration was performed through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, suggesting that the registration may be compromised or that the domain was leveraged after a lapse in control.

The available evidence confirms that mettaamsklogine.webflow.io was used in a crypto‑related brand impersonation campaign targeting MetaMask users, although the site is presently offline and returns a 404 status. Uncertainty remains regarding the original phishing kit, the extent of victim exposure, and whether additional infrastructure components (e.g., command‑and‑control servers) were associated with the domain. Defenders should update URL filtering and DNS sinkhole rules to block the domain and its associated IP address, continue to monitor the registrar for any re‑registration activity, and consider reviewing historic traffic logs for requests to the domain or its IP.