metamaskextesioxn[.]webflow[.]io

The domain metamaskextesioxn.webflow.io was observed hosting a brand‑impersonation page that claimed to represent the MetaMask browser extension, as indicated by the page title “MetaMask® Extension® – Browser extension – webflow”. The site was registered through MarkMonitor, Inc., and the domain creation date is listed as May 08 2013. Infrastructure analysis shows the domain resolves to the Cloudflare address 104.18.36.248, which belongs to AS13335 owned by Cloudflare, Inc., and the hosting location is the United States. The authoritative name servers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. SSL termination is provided by Google Trust Services under the WE1 certificate, indicating a valid TLS certificate was in place at the time of capture.

Reputation services have flagged the domain: VirusTotal recorded 16 detections out of 95 scanned vendors, and it appears on at least one public security blocklist. PhishDestroy has also listed the domain as blocked. The HTTP response returned a 404 status code, suggesting the malicious page may have been removed or the site taken offline; the current status is reported as offline. Detected technologies include Cloudflare and HTTP/3, consistent with the observed hosting environment.

Given the combination of brand‑targeted page title, crypto‑scam classification, and multiple vendor detections, the domain should be treated as a confirmed malicious indicator. Defensive actions include adding the domain to blocklists at the network perimeter, updating web‑filtering and DNS‑sinkhole rules, and monitoring for any resurgence of the host under the same IP address or similar sub‑domains. Analysts should also watch for related phishing kits that reference MetaMask, as the use of a legitimate registrar suggests potential abuse of compromised brand assets. Continuous observation of the IP 104.18.36.