metamxsklogius[.]webflow[.]io

This domain, metamxsklogius.webflow.io, is flagged as a brand impersonation threat targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the domain was created on May 8, 2013, though its use in malicious activity appears recent, given its presence on one security blocklist (PhishDestroy) and detection by 13 of 95 security vendors on VirusTotal. The domain is currently offline, returning an HTTP 404 status, and is hosted on Cloudflare infrastructure (AS13335) with an IP resolution of 172.64.151.8. Nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) and SSL certificate issuer (Google Trust Services / WE1) align with Cloudflare's standard configuration, which is commonly leveraged by both legitimate and malicious actors for anonymity and resilience.

The page title, 'Metamask Login - Your key to blockchain,' explicitly suggests an attempt to mimic MetaMask's branding, reinforcing the classification as a crypto scam. While the domain's registration details list MarkMonitor, Inc. as the registrar, this does not inherently indicate malicious intent, as legitimate entities also use this provider. No evidence of a phishing kit or additional infrastructure (e.g., redirect chains, C2 domains) is present in the available data. The scam type is categorized as a crypto scam, though the exact mechanics (e.g., credential harvesting, wallet drainer) remain unconfirmed due to the domain's offline status.

Defenders should treat this domain as high-risk for MetaMask users and prioritize blocking it at the DNS or proxy level. Given its presence on one blocklist and detection by multiple security vendors, retrospective log analysis for connections to 172.64.151.8 or the domain itself is recommended. If the domain reactivates, immediate takedown requests should be submitted to Cloudflare and Webflow, with additional monitoring for related infrastructure (e.g., newly registered domains with similar naming patterns or Cloudflare hosting).