matemasklogiini[.]webflow[.]io

This domain, matemasklogiini.webflow.io, is a confirmed brand impersonation targetting MetaMask, the cryptocurrency wallet. It was reported on July 23, 2026, and is currently offline. The page title was 'MetaMask® Łøgin - Connect to the Decentralized', which mimics the legitimate MetaMask login interface. Google Safe Browsing flags this domain for social engineering, and 18 of 93 security vendors on VirusTotal flagged it as malicious. It appears on one security blocklist and is blocked by PhishDestroy.

The domain resolves to IP 104.18.36.248, hosted by Cloudflare, Inc. (AS13335) in the United States. The nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The domain was registered through MarkMonitor, Inc. and was created on May 08, 2013, which is unusually old for a phishing domain, suggesting it may have been compromised or repurposed. The SSL certificate is issued by Google Trust Services (WE1), and the HTTP status returns 404, indicating the content is no longer accessible.

Analysis confirms this is a crypto scam designed to steal login credentials or private keys. Defenders should block this domain at the network level, add it to threat intelligence feeds, and monitor for similar subdomains under webflow.io. Users who interacted with this site should reset their MetaMask credentials and enable two-factor authentication. The exact phishing kit or method is not yet identified, but the infrastructure is consistent with a credential harvesting operation hosted on a legitimate platform (Webflow) to evade detection.