metamasklogiiin[.]webflow[.]io

On July 24, 2026, the domain metamasklogiiin.webflow.io was observed to be taken offline after being identified as a brand‑impersonation site targeting MetaMask. Registration data shows the domain was registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, and the DNS records point to Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The host resolves to the IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. TLS negotiation is performed by a certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS connection despite the malicious intent.

HTTP requests to the site return a 404 status code and the page title reported by scanners is “404 - Page not found,” suggesting that the landing page has been removed or was never deployed. Technical fingerprinting detected the use of Cloudflare’s edge network and HTTP/3 protocol, consistent with the infrastructure commonly leveraged by threat actors to hide behind reputable services. VirusTotal analysis recorded 13 detections out of 95 security scanners, confirming that multiple vendors flag the domain as malicious. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist, further corroborating its classification as a crypto‑related scam.

No additional public intelligence such as OTX or Safe Browsing entries were provided, leaving the broader campaign context unknown. The lack of a live webpage limits the ability to extract payloads or phishing templates, but the combination of brand impersonation, a legitimate‑looking registrar, and Cloudflare hosting aligns with known tactics used for crypto‑drainer or credential‑harvesting campaigns targeting MetaMask users. Defenders should continue to block the domain at DNS and proxy layers, monitor outbound traffic for connections to 172.64.151.