meetamaskcrypt0signin[.]webflow[.]io

This domain, meetamaskcrypt0signin.webflow.io, is identified as a high-risk phishing resource targeting MetaMask, a cryptocurrency wallet service. The page title, 'Metamask® login - Metamask® - US | MetaMask Sign in,' explicitly mimics the legitimate MetaMask authentication portal, aiming to deceive users into submitting credentials or private keys. No direct evidence of a drainer kit was observed, though the domain structure and hosting pattern align with known credential-harvesting campaigns. The impersonation technique leverages visual and textual replication of the official MetaMask interface to exploit user trust. Analysis indicates the domain was registered through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. It resolves to the IP address 104.18.36.248, hosted on Cloudflare’s infrastructure (AS13335). The domain creation date is May 8, 2013, though the subdomain likely represents a more recent compromise or misuse of a legitimate Webflow.io account. Google Safe Browsing flags the domain as phishing, and it appears on two security blocklists. VirusTotal reports 16 out of 95 security vendors detecting the domain as malicious. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. The domain is currently offline, likely following takedown actions or internal suspension by the hosting provider. Despite its inactive status, residual risk remains due to the potential for re-emergence under a similar or altered domain. Organizations and users are advised to monitor for related indicators, including the resolved IP and registrar details, and to implement real-time blocklisting for known phishing infrastructure. Endpoint protection systems should be updated to recognize the specific page title and MetaMask impersonation patterns observed in this campaign.