methimasklogin[.]webflow[.]io

The domain methimasklogin.webflow.io was registered on February 21, 2026 through NameCheap, Inc. and is presently taken offline. Infrastructure analysis shows the domain resolves to IP address 172.64.151.8, which is part of Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, indicating a legitimate‑looking HTTPS endpoint despite the malicious intent. HTTP probing returned a 404 status with the page title "404 - Page not found," suggesting the landing page has been removed or never hosted substantive content.

Technical fingerprinting identified Cloudflare services and HTTP/3 support, both common in legitimate and fraudulent sites. Google Safe Browsing classifies the domain as social engineering, and VirusTotal records 13 of 93 scanning vendors flagging it for malicious behavior, reinforcing the suspicion of credential theft. The domain explicitly impersonates the MetaMask brand and is categorized as a credential phishing campaign aimed at harvesting user login details. Defensive feeds have already added the domain to at least one blocklist, and PhishDestroy confirms active blocking.

While the current offline status limits immediate observation, the combination of brand impersonation, SSL issuance by a trusted authority, and multi‑vendor detections indicates a high‑risk threat. Security teams should continue to block the domain at network perimeter devices, monitor for any resurgence of the host, and advise users to verify URLs before entering MetaMask credentials. Ongoing threat‑intel collection is advised to track potential re‑registration or variant domains that may reuse the same impersonation tactics.