metmseke-login[.]webflow[.]io

The domain metmseke-login.webflow.io is currently offline but exhibits multiple indicators consistent with a brand‑impersonation campaign targeting MetaMask users. Registration data shows the domain was created on May 08, 2013 and is managed through MarkMonitor, Inc., a registrar commonly used for legitimate brand assets, suggesting the attacker leveraged a reputable registrar to increase perceived legitimacy. DNS resolution points to Cloudflare’s network (ASN13335) with the IP address 104.18.36.248 located in the United States; the nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com further confirm Cloudflare hosting. The site served an SSL certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake and a trusted certificate chain, which can help bypass basic certificate checks.

HTTP analysis returned a 404 status code, and the only visible page title was "Getting started with MetaMask - Metamask® login," directly referencing the MetaMask brand and reinforcing the impersonation intent. Technical fingerprinting identified Cloudflare’s edge services and HTTP/3 support, both typical of legitimate sites but also frequently abused by malicious operators to obscure origin. VirusTotal analysis recorded 16 detections out of 95 scanned security vendors, reflecting a moderate consensus of malicious behavior.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy, further corroborating its classification as a phishing or crypto‑scam vector. Given the elevated risk rating and the concrete evidence of brand abuse, defenders should add the domain and its associated IP to outbound and inbound filtering rules, monitor for any re‑activation, and enforce user education about unsolicited MetaMask login prompts. Continuous scanning of the IP range and associated subdomains is advised to detect potential repurposing of the same infrastructure for future campaigns.