web-en-mettsk[.]webflow[.]io

This domain is flagged as an elevated-risk brand impersonation threat targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the site was designed to deceive users into disclosing sensitive credentials or wallet recovery phrases, likely for crypto asset theft. The specific threat type is a fake login portal, as evidenced by the page title 'MetaMask Login: Step-by-Step Setup for Beginners,' which mimics legitimate onboarding materials to lower user vigilance. Infrastructure analysis reveals the domain web-en-mettsk.webflow.io resolves to IP 172.64.151.8, hosted on Cloudflare infrastructure (AS13335) in the United States. The domain was registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious purposes. Detection metrics show 12 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a valid but non-exclusive indicator of legitimacy. The domain creation date of May 08, 2013, is misleading; the subdomain itself is recently deployed for malicious purposes, as Webflow.io is a platform-as-a-service provider allowing rapid domain spin-up without traditional registration. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP (172.64.151.8) at the network perimeter. Organizations should update endpoint protection rules to flag or quarantine any outbound connections to this domain. Users who may have interacted with the site should be directed to revoke active sessions, rotate credentials, and check wallet addresses for unauthorized transactions. Given the offline status, monitoring for re-emergence under similar subdomains (e.g., webflow.io variants) is recommended. Security teams should prioritize retrospective log analysis to identify any prior exposure or data exfiltration attempts.