metmsklaloghn[.]webflow[.]io

This domain, metmsklaloghn.webflow.io, has been identified as engaging in high-risk brand impersonation activities specifically targeting MetaMask. The threat level has been categorized as high due to its potential impact on unsuspecting users attempting to access MetaMask services, resulting in compromised security and data theft.

The domain was registered through Webflow and utilizes technologies such as Cloudflare and HTTP/3. It resolved to the IP address 172.64.151.8 and was found using an SSL certificate issued by Google Trust Services. It appears on 3 security blocklists including MetaMask, PhishDestroy, and SEAL. Analysis from VirusTotal shows 16 out of 95 security vendors have flagged this domain for malicious intent. The page titled 'Metamask Login | Swap Crypto & Exchange Digital Tokens' was designed to deceive users into believing they are interacting with the legitimate MetaMask platform.

Mitigation steps for this type of threat include ensuring that users are aware of official MetaMask URL patterns and verify the authenticity of the sites they visit. Users should maintain updated security tools and blocklists to proactively detect and block similar phishing domains. As this domain is now offline, ongoing monitoring for similar tactics and domains should be upheld to prevent future impersonation risks.