metuiuetsmassklogin[.]webflow[.]io

The domain metuiuetsmassklogin.webflow.io was observed delivering a brand‑impersonation page that uses the exact page title "MetaMask® Login |The crypto wallet for Defi, Web3 Dapps and NFTs" to suggest a legitimate MetaMask authentication portal. Infrastructure analysis shows the domain resolves to 172.64.151.8, an address owned by Cloudflare (AS13335) and located in the United States. The site was provisioned through the Webflow registrar, and its DNS configuration reports NS_NOT_FOUND, indicating that standard nameserver records were not publicly available at the time of analysis. The TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority, confirming a valid HTTPS connection but offering no assurance about the underlying content.

HTTP probing returned a 404 status, and the site is currently marked as offline, suggesting the operators have taken it down or are rotating infrastructure. Malware and URL scanning services on VirusTotal flagged the domain in 16 out of 93 scans, reinforcing the suspicion of malicious intent. The domain has been added to at least one external blocklist and was actively blocked by the PhishDestroy service, which classifies the activity as a crypto‑related scam. The page title and the explicit reference to MetaMask indicate a targeted attempt to harvest credentials from users of the MetaMask wallet extension, a common vector for crypto‑draining attacks.

Defenders should continue to block the domain at network perimeter controls, monitor for any resurgence of the host on the same IP range, and add the domain to internal threat‑intel feeds. Users should be warned that any unsolicited request to log in to MetaMask via a URL containing "metuiuetsmassklogin.webflow.io" is not legitimate, and credential submission on such pages may result in loss of crypto assets.