metamask-wallets[.]webflow[.]io

This domain presents an elevated risk as a brand impersonation attempt specifically targeting MetaMask users. Rather than a generic phishing page, this site was designed to mimic the legitimate MetaMask wallet interface, aiming to deceive users into connecting their wallets or sharing sensitive credentials. The combination of a convincing page title and a known domain registrar underscores the sophistication of this threat.

PhishDestroy identified several critical indicators: VirusTotal flagged this domain by 16 of its 95 security vendors, reflecting broad consensus on its malicious nature. The domain was registered through MarkMonitor, Inc. and created on May 08, 2013, which may lend a false sense of legitimacy. It resolves to IP address 2606:4700:440c::ac40:9708 (Cloudflare) and uses an SSL certificate from Google Trust Services. Additionally, the domain appears on two security blocklists, confirming its reputation as a threat.

To stay safe, users should always verify the official URL of MetaMask (metamask.io) before interacting. Never connect a wallet or enter seed phrases on third-party sites. If this domain is still accessible in any form, report it to the hosting provider and relevant security platforms. Enable browser protections and use a reputable anti-phishing tool to block such impersonation attempts proactively.