mitumcklcicn[.]webflow[.]io

Analysis of mitumcklcicn.webflow.io indicates that the domain is being leveraged for a MetaMask brand impersonation campaign. The site was registered on May 08, 2013 through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services, yet the domain is hosted on Cloudflare infrastructure (IP 172.64.151.8, AS13335 Cloudflare, Inc., United States). DNS resolution points to Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the service presents an SSL certificate issued by Google Trust Services under the WE1 label, confirming TLS termination at the CDN edge.

HTTP probing returns a 404 status, suggesting the original payload has been removed or the site is intentionally unavailable; however, the page title captured in the scan reads “Metanmask login | The crypto wallet for Defi, Web3 Dapps and”, which aligns with the declared scam type of a crypto scam targeting MetaMask users. VirusTotal records show that 14 of 95 scanned security vendors flagged the domain, and the domain appears on a single blocklist, currently listed by PhishDestroy. The combination of brand‑specific page title, elevated risk rating, and multiple vendor detections supports the classification as a brand‑impersonation threat.

Defenders should add the hostname and its resolving IP to network‑level deny lists, enforce URL filtering for the exact page title pattern, and monitor Cloudflare‑associated address ranges for related activity. Because the site is presently offline, continuous re‑verification is advised to detect any re‑activation. The evidence base is limited to passive scans; no active content has been observed, and the exact phishing kit remains unidentified.