metamaskelogwiniutye[.]webflow[.]io

Analysis of the domain metamaskelogwiniutye.webflow.io confirms its classification as a phishing site targeting MetaMask users, with elevated risk due to brand impersonation and cryptocurrency scam indicators. The domain was registered on May 8, 2013, through MarkMonitor, Inc., though this early registration date may reflect historical ownership unrelated to the current malicious activity. Infrastructure analysis reveals the site was hosted behind Cloudflare, utilizing nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and resolving to the IP address 172.64.151.8, which is part of Cloudflare’s network (AS13335) located in the United States. The use of Cloudflare’s services, including HTTP/3 and a Google Trust Services SSL certificate (WE1), aligns with common phishing infrastructure patterns designed to obscure hosting origins and evade detection.

The page title, 'Metamask Login | The crypto wallet for Defi, Web3 Dapps,' directly impersonates MetaMask’s branding, a key indicator of intent to deceive users into divulging cryptocurrency wallet credentials. As of the report date, the domain appears on at least one security blocklist and is flagged by 15 of 95 security vendors on VirusTotal, confirming its malicious classification. The scam type is explicitly identified as a crypto scam, though specific attack vectors (e.g., credential harvesting, wallet drainer scripts) remain unconfirmed due to the site’s current offline status and lack of accessible content for deeper analysis. Defenders should treat this domain as a confirmed threat.

The HTTP 404 status indicates the site is no longer serving content, but historical or cached versions may still pose risks. Organizations are advised to block the domain and its resolving IP (172.64.151.8) at the network level, update endpoint protection rules, and monitor for related infrastructure, particularly any reuse of Cloudflare or MarkMonitor-registered domains.