metamaskkcrypt0login.webflow.io
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of metamaskkcrypt0login.webflow.io
This website appears to be a Webflow-hosted page presenting itself as a MetaMask login or sign-in page. The page title and meta description both reference "metamask login" and related terms, while the screenshot shows branding and layout elements resembling the well-known cryptocurrency wallet service MetaMask. Its apparent purpose may be to attract users looking for wallet access, downloads, or account-related help.
Based on the domain structure, this is a subdomain hosted on webflow.io rather than an official MetaMask-owned domain. The string "metamaskkcrypt0login" combines the MetaMask brand name with login-related wording and altered spelling, which may indicate an attempt to resemble the legitimate service. The site appears to target cryptocurrency users, a group commonly targeted by credential-harvesting and wallet-draining campaigns.
Safety Assessment for metamaskkcrypt0login.webflow.io
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 17 out of 91 security engines, and several independent phishing-focused detections were present. In addition, a major threat database listed the page for social-engineering activity. Although one malware scan reported no malicious files, that result does not outweigh the broader consensus pointing to phishing-related behavior.
The domain name closely resembles the MetaMask brand while adding extra characters and login-themed wording, and the screenshot appears to imitate MetaMask's visual presentation. That combination may indicate a look-alike page intended to capture wallet credentials, seed phrases, or other sensitive information from cryptocurrency users. The domain's IP address was also listed on one mail-reputation blocklist, which is a weaker signal than phishing detections but still adds minor caution.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL certificate issued by a mainstream certificate authority and is served through Cloudflare infrastructure on IP address 104.18.36.248, with hosting geolocated to Canada based on available data. Nameservers are delegated to Cloudflare, and the page loads static assets from Webflow-related content delivery domains. DNSSEC appears to be unsigned.
From a technical standpoint, the presence of HTTPS only indicates encrypted transport and should not be treated as proof of legitimacy. The main concern here is not TLS configuration but the apparent brand imitation on a third-party hosted subdomain, combined with strong phishing-related reputation signals at the time of the scan.
Share your experience with this website. Was it safe? Did you encounter any issues?