matmskshlogi[.]webflow[.]io

The domain matmskshlogi.webflow.io was identified as a brand‑impersonation site targeting MetaMask users. The page title observed in earlier crawls reads “Metamask Login – Browser Extension | Digital Crypto Wallet”, indicating an attempt to lure victims into entering wallet credentials. VirusTotal reports indicate that 15 of 95 scanned engines flagged the host, reflecting a moderate level of malicious confidence. Registration data shows the domain was created on 08 May 2013 and is managed through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may aid evasion.

DNS resolution points to 172.64.151.8, an address owned by Cloudflare (AS13335) located in the United States. The site employed Cloudflare services, including HTTP/3, and presented a TLS certificate issued by Google Trust Services under the WE1 root, confirming the use of a valid public‑trusted certificate. Nameserver records list journey.ns.cloudflare.com and lamar.ns.cloudflare.com, consistent with the hosting provider. At the time of analysis the HTTP response returned a 404 status code and the domain is reported offline, suggesting the malicious payload has been removed or the operators have taken the site down.

Nonetheless, the domain appears on at least one security blocklist and was blocked by PhishDestroy, reinforcing its classification as a crypto‑related scam. The combination of a convincing MetaMask‑oriented page title, a reputable TLS certificate, and Cloudflare infrastructure makes the site capable of bypassing naïve URL‑based filters. Defenders should continue to block the domain at perimeter and endpoint layers, monitor for any re‑registration or reuse of the same host IP, and update threat‑intel feeds with the observed indicators. Additional investigation of historical snapshots or archived content may reveal the exact phishing flow that was previously served.