mwtamsckloggin[.]webflow[.]io

Analysis date: July 23, 2026. The domain mwtamsckloggin.webflow.io is registered through MarkMonitor, Inc. and was originally created on May 08, 2013. DNS resolution points to the IPv6 address 2606:4700:440c::ac40:9708, which is owned by Cloudflare (AS13335) and located in the United States. Authoritative nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com confirm that the site is fronted by Cloudflare's edge network.

TLS termination is provided by a Google Trust Services certificate issued under the WE1 label, and the service is observed to support HTTP/3. The only page title returned by the server is "MetaMask Portfolio," aligning with the declared target brand MetaMask. The domain is categorized as a crypto‑related brand‑impersonation scam and is listed on one security blocklist, specifically PhishDestroy. VirusTotal scans have flagged the domain with 15 positive detections out of 95 scanners, providing additional evidence of malicious intent.

An HTTP request yields a 404 response, indicating that the landing page is currently unavailable, which matches the reported offline status. No additional content has been captured, so the exact phishing payload or credential‑harvesting technique remains unknown. Defenders should block the domain at DNS and proxy layers, add the associated IPv6 address to deny lists, and monitor for any re‑activation. Users should be warned against unsolicited MetaMask‑related URLs, and any traffic to this host should be treated as malicious for incident‑response triage.