metamskkclogin[.]webflow[.]io

Analysis of the domain metamskkclogin.webflow.io indicates it was a credential-phishing site targeting MetaMask users. The domain, registered on February 21, 2026, through NameCheap, Inc., resolved to IP 172.64.151.8 (AS13335 Cloudflare, Inc., US) and was served via Cloudflare with HTTP/3 support. As of July 23, 2026, the domain returns an HTTP 404 status with the page title '404 - Page not found,' suggesting it has been taken offline or removed by the hosting provider. Prior to deactivation, 13 of 93 security vendors on VirusTotal flagged the domain, and it appeared on one security blocklist.

The SSL certificate was issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious sites. Infrastructure analysis reveals the use of Webflow, a platform frequently exploited for rapid deployment of phishing pages due to its ease of use and free tier. No evidence of the original phishing page content is available, as the domain currently serves no functional content.

Defenders should treat any prior resolution of this domain as a high-confidence indicator of compromise (IOC) for credential theft targeting MetaMask users. Network logs should be reviewed for connections to 172.64.151.8 or requests to metamskkclogin.webflow.io, particularly from endpoints where MetaMask or other cryptocurrency wallet extensions are installed. Blocking the domain at DNS and proxy levels is recommended to prevent residual exposure.