matamaskcriptologgin[.]webflow[.]io

This domain, matamaskcriptologgin.webflow.io, is identified as a high-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet. Analysis indicates the site replicates MetaMask’s login interface, including page titles such as 'metamask login,' 'metamask sign in,' and 'metamask login error,' designed to deceive users into entering credentials. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting tactics commonly used to facilitate subsequent wallet compromises.

Technical indicators confirm the domain’s malicious nature. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. The site is hosted on Webflow’s infrastructure and resolves to IP address 172.64.151.8, associated with Cloudflare, Inc. (AS13335). Google Safe Browsing classifies the domain as phishing, and it appears on three independent security blocklists. No creation date was provided, but the domain’s subdomain structure suggests it was deployed rapidly to evade detection, a common tactic in phishing campaigns.

As of the latest assessment, matamaskcriptologgin.webflow.io has been taken offline, likely due to enforcement actions by security providers or the hosting platform. Despite its current inactive status, the domain’s prior activity poses residual risks, including potential reuse or rebranding under a different subdomain. Users who interacted with the site should assume credential exposure, revoke active sessions, and monitor associated wallet addresses for unauthorized transactions. Organizations are advised to update blocklists to include the domain and its resolved IP to prevent future access attempts.