login-metsahelp[.]webflow[.]io

This domain, login-metsahelp.webflow.io, is identified as a high-risk phishing infrastructure designed to impersonate MetaMask, a widely used cryptocurrency wallet service. The threat type is classified as brand impersonation, specifically targeting users through a fake login portal titled 'MetaMask® Login® | Getting started with …'. Analysis indicates the intent is to harvest cryptocurrency wallet credentials, potentially leading to unauthorized access and asset theft. No explicit drainer kit signatures were observed, but the page structure aligns with credential-phishing campaigns commonly deployed against crypto wallet users. Infrastructure analysis reveals the following technical indicators: the domain was created on May 8, 2013, though repurposed for malicious activity, and is registered through MarkMonitor, Inc. It resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic. The domain appears on three security blocklists, including PhishDestroy, MetaMask’s internal systems, and SEAL. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. No Google Safe Browsing (GSB) entries were confirmed at the time of analysis, though this may reflect detection lag rather than absence of risk. The domain is currently offline, reducing immediate exposure to end users. However, the infrastructure remains a latent threat due to its prior use in credential theft operations. Response actions include blocklisting by multiple security entities and potential takedown coordination with the hosting provider. Remaining risks include the possibility of the domain resurfacing under altered infrastructure or being reused in future campaigns. Users who may have interacted with this domain are advised to revoke any active sessions, reset credentials, and monitor wallet transactions for unauthorized activity. Organizations should update detection rules to include this domain and associated IP in threat intelligence feeds to prevent recurrence.