polygon-wallet-polygon[.]webflow[.]io

The domain polygon-wallet-polygon.webflow.io was flagged on July 24, 2026 as a brand impersonation site targeting MetaMask users. Technical inspection shows the domain is hosted behind Cloudflare's network (AS13335) and serves content over HTTP/3, with a Google Trust Services / WE1 SSL certificate terminating at IP address 172.64.151.8, an address located in the United States. The domain was registered on May 08, 2013 through MarkMonitor, Inc., and the authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. A public page title, "Getting Started With MetaMask on Polygon," explicitly references the MetaMask brand, confirming the impersonation intent.

The site returned an HTTP 404 status at the time of analysis, indicating the primary landing page is unavailable or has been removed. The domain appears on a single security blocklist and has been listed by PhishDestroy as offline, suggesting that takedown or remediation actions have already been applied. VirusTotal reports that 16 of 93 scanning engines flagged the domain, providing independent corroboration of malicious activity. The classification as a crypto scam aligns with the MetaMask branding and the reference to Polygon, a known Ethereum scaling solution.

While the current offline state limits immediate threat exposure, defenders should continue to monitor the domain's IP and any associated subdomains for reactivation, and enforce blocklist updates in corporate web filters. Security teams should also update brand‑specific threat intel for MetaMask to include this domain, ensuring that endpoint and email security solutions can detect any residual artifacts, such as URLs or phishing email templates that may reference the compromised site. Continuous observation of Cloudflare‑hosted IP ranges for similar impersonation attempts is recommended, given the platform's frequent misuse by threat actors.