metamaskloesgin[.]webflow[.]io

The domain metamaskloesgin.webflow.io is presently classified as a crypto‑drainer infrastructure. Registration data indicates the site was provisioned through the Webflow platform, a SaaS website builder that also supplies DNS services. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service, demonstrating that at least one protective feed has flagged the address. VirusTotal analysis shows that 13 of 91 scanned security engines have raised detections, confirming a non‑trivial level of malicious labeling across independent scanners.

The presence on a blocklist and multiple vendor detections together suggest that the site is being used to harvest cryptocurrency credentials or to route victims to malicious wallets. No additional intelligence such as hosting IP, ASN, or SSL certificate details has been disclosed, leaving the underlying server location and certificate trust profile unverified. Consequently, defensive operators should add the domain to network‑level deny lists, enforce browser‑based URL filtering that includes the PhishDestroy feed, and monitor DNS queries for any resolution of the host.

Continuous re‑evaluation is advised, as further analysis may reveal additional indicators such as phishing page content, command‑and‑control endpoints, or associated phishing kits. Until a more complete forensic profile is obtained, the domain should be treated as high‑risk for any attempts to interact with cryptocurrency wallet services. Organizations are urged to incorporate the indicator into threat‑intel platforms and to share any observed activity with information‑sharing communities.