meitmsklagon[.]webflow[.]io

This domain is flagged as a high-risk brand impersonation threat targeting MetaMask users through a fraudulent login portal. Analysis indicates the site was designed to mimic the official MetaMask authentication interface, likely to harvest cryptocurrency wallet credentials or deploy crypto-draining malware. The page title, 'MetaMask® login #Metamask® Extension® | us,' reinforces the deception by incorporating official branding elements to appear legitimate. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain, meitmsklagon.webflow.io, is flagged by 14 out of 95 security vendors on VirusTotal, while Google Safe Browsing explicitly classifies it as phishing. It resolves to the IP address 172.64.151.8, hosted on Cloudflare's network (AS13335). Despite an unusually early creation date of May 8, 2013, the domain exhibits characteristics of a recently repurposed or typosquatted asset. The SSL certificate, issued by Google Trust Services (WE1), provides minimal trust assurance, as fraudulent sites commonly abuse free or automated certificate issuance. The domain is registered through MarkMonitor, Inc., a registrar frequently associated with both legitimate and malicious domains. It appears on one security blocklist, specifically PhishDestroy, and has since been taken offline, though residual risks may persist. Mitigation steps for this threat type include immediate revocation of any credentials entered on the fraudulent site, particularly MetaMask seed phrases or private keys. Users should verify domain authenticity by cross-referencing official sources and inspecting SSL certificates for anomalies. Network-level protections, such as DNS filtering or endpoint detection rules, should block resolutions to 172.64.151.8 and related subdomains. Organizations should monitor for indicators of compromise, including connections to the identified IP or certificate thumbprints, and conduct retrospective log analysis for prior exposure. Given the high-risk nature of crypto wallet impersonation, affected users should assume full credential compromise and initiate wallet migration to new, secure addresses.