metmseklogien[.]webflow[.]io

metmseklogien.webflow.io is flagged as a brand‑impersonation site targeting MetaMask users. The domain was created on 08 May 2013 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises. DNS resolution points to 104.18.36.248, an address owned by Cloudflare (AS13335) located in the United States. The authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming that the site is hosted behind Cloudflare’s edge network. HTTP requests receive a 404 response, and the site serves a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid certificate chain but offering no assurance of legitimacy.

The page title returned by the server is “MetaMask developer documentation - Login”, which aligns with the declared impersonation of the MetaMask brand. VirusTotal analysis shows that 12 of 95 scanning engines have flagged the domain, and the domain appears on at least one public blocklist. PhishDestroy has also blocked the domain, and the overall classification is a crypto‑scam. The presence of Cloudflare and HTTP/3 suggests that the operators are leveraging a common CDN to hide origin infrastructure.

While the site is currently offline, the combination of an authentic‑looking TLS certificate, a brand‑specific page title, and multiple vendor detections indicates a deliberate attempt to harvest MetaMask credentials or lure victims into a cryptocurrency‑related fraud. Defenders should add the domain to blocklists for inbound and outbound traffic, monitor DNS queries for the domain and its associated IP address, and enforce strict brand‑based allow‑lists for MetaMask‑related URLs. Because the domain uses a reputable registrar and a valid certificate, automated allow‑list rules that rely solely on certificate authority reputation may miss this threat; contextual indicators such as the page title and the detection count should be incorporated into detection logic.