Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://metamaskloginr.webflow.io
Detected Brand
MetaMask
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
b7049a33-e6d…
Analyzed
2026-01-26 05:12
Final URL (after redirects)
https://metamaskloginr.webflow.io/
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1344155637602B42D7B1656F8D510B2ECC04243AECE50F884D9C089DD968ECCA5442BAE |
|
CONTENT
ssdeep
|
48:/WmfDhv5Qx/q0LkYX0Tl0n0w4Uzeu531hDEf6:ThiNL+Tq0mr5llEf6 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
af2de0c90d2c2f0f |
|
VISUAL
aHash
|
bbff03133f83ffff |
|
VISUAL
dHash
|
528c6e6664232300 |
|
VISUAL
wHash
|
03e303033381fffe |
|
VISUAL
colorHash
|
07c000000c0 |
|
VISUAL
cropResistant
|
528c6e6664232300 |
Code Analysis
Risk Score
100/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Personal Info
🔒 Obfuscation Detected
- atob
- fromCharCode
- base64_strings
🎯 Kit Endpoints
- https://metamaskloginr.webflow.io/
📡 API Calls Detected
- https://www.google.com/ccm/geo
- POST
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected Credential Harvester and Personal Info kit types, indicating real-time data interception and exfiltration capabilities.
Brand Impersonation
Domain impersonates MetaMask, a high-value cryptocurrency wallet target, increasing likelihood of successful social engineering.
Obfuscation Techniques
34 obfuscation techniques detected in JavaScript, indicating deliberate evasion of static analysis and automated detection.
Domain Reputation
Domain hosted on webflow.io, a legitimate platform often abused for phishing due to free hosting and SSL certificates.
🔬 Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
MetaMask users
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Unknown
Risk Assessment
CRITICAL - Automated credential harvesting with Unknown
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Personal Info
- 34 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
MetaMask
Official Website
https://metamask.io
Fake Service
MetaMask wallet login and account verification
⚔️ Attack Methodology
Primary Method: Wallet Connection Spoofing
The phishing site mimics MetaMask's wallet connection interface to trick users into approving malicious smart contract interactions. This allows attackers to request token approvals or drain assets directly from connected wallets.
Secondary Method: Credential Harvesting
The site includes forms designed to capture MetaMask seed phrases or private keys, enabling full account takeover and irreversible asset theft.
Target Blockchain
Ethereum
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
metamaskloginr.webflow.io
Registered
Unknown
Registrar
Unknown
Status
Active (age unknown)
🦠 Malicious Files
Main File
File Size
Highly obfuscated JavaScript file with 34 detected obfuscation techniques, likely containing credential harvesting logic.
📊 Attack Flow Diagram
Here's a generic ASCII art attack flow diagram for the described phishing attack:
```
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM TARGETED │
│ - Fake MetaMask page delivered via phishing │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. WALLET CONNECTION SPOOFING │
│ - Fake interface mimics legitimate wallet connection │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. USER INTERACTION │
│ - Victim attempts to connect wallet │
│ - Fake prompts request sensitive information │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA CAPTURE │
│ - Entered information collected by fake interface │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 5. EXFILTRATION │
│ - Collected data sent via HTTP POST │
└──────────────────────────────────────────────────────────┘
```
🔬 JavaScript Deep Analysis
Sophistication Level
Basic
Total Code Size
36.1 KB
🔗 API Endpoints Detected
Other
6
Backend API
1
🔐 Obfuscation Detected
- : Light
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
Here's a generic ASCII art attack flow diagram for the described phishing attack:
```
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM TARGETED │
│ - Fake MetaMask page delivered via phishing │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. WALLET CONNECTION SPOOFING │
│ - Fake interface mimics legitimate wallet connection │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. USER INTERACTION │
│ - Victim attempts to connect wallet │
│ - Fake prompts request sensitive information │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA CAPTURE │
│ - Entered information collected by fake interface │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 5. EXFILTRATION │
│ - Collected data sent via HTTP POST │
└──────────────────────────────────────────────────────────┘
```
🎯 Malicious Files Identified
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for metamaskloginr.webflow.io
Found 3 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.