meitmsklgxn[.]webflow[.]io

Analysis of the domain meitmsklgxn.webflow.io indicates it was actively impersonating MetaMask, a cryptocurrency wallet service, as of its last known operational state. The domain resolved to IP 172.64.151.8, hosted on Cloudflare infrastructure (AS13335) with nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, both associated with Cloudflare's network. The SSL certificate was issued by Google Trust Services under the WE1 intermediate, a common configuration for Cloudflare-protected sites. The page title, 'MetaMask® Login - Your Secure Access to DApps,' explicitly suggests an attempt to deceive users into believing they were accessing legitimate MetaMask authentication, aligning with the reported scam type of a crypto scam. The domain was flagged by 15 of 95 security vendors on VirusTotal, a detection rate that confirms malicious classification by multiple engines.

It also appeared on at least one security blocklist, further validating its risk profile. At the time of assessment, the domain returned an HTTP 404 status, indicating it was taken offline or disabled, though defenders should note that infrastructure may remain under the control of threat actors for potential reuse. Registration details trace back to MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains, with the domain initially created on May 8, 2013, though this date may not reflect the timeline of its malicious use. Defenders are advised to treat this domain as part of a brand impersonation campaign targeting MetaMask users.

While the site is currently offline, monitoring for DNS reactivation, subdomain reuse, or IP reassignment is recommended. Blocking the domain and its resolved IP at perimeter security controls can mitigate residual risk. If internal logs indicate prior access attempts from this domain, initiate user awareness and credential reset procedures, particularly for cryptocurrency-related accounts.