metammaskd-login[.]webflow[.]io

This domain, metammaskd-login.webflow.io, poses a high-risk credential theft threat by impersonating MetaMask, a widely used cryptocurrency wallet. The infrastructure is designed to deceive users into entering sensitive login credentials, which are then harvested for unauthorized access to digital assets. The fraudulent page mimics MetaMask’s branding and user interface, leveraging a seemingly legitimate title, 'Navigating the World of Decentralized Finance: The Metamask Login Experience,' to lower user defenses and increase the likelihood of successful compromise. Analysis of the domain reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through NameCheap, Inc., and is hosted on Cloudflare infrastructure at IP address 172.64.151.8. It is flagged by 18 out of 95 security vendors on VirusTotal, and appears on three independent security blocklists. The SSL certificate, issued by Google Trust Services (WE1), adds a superficial layer of legitimacy, though this is a common tactic in phishing campaigns to evade initial suspicion. The domain’s current offline status suggests takedown actions, but similar infrastructure may re-emerge under different identifiers. Users who visited metammaskd-login.webflow.io should assume their credentials were compromised. Immediate steps include revoking access to any connected cryptocurrency wallets, enabling multi-factor authentication on all financial accounts, and monitoring for unauthorized transactions. If login details were entered, users should transfer remaining assets to a new, secure wallet and audit all linked accounts for signs of compromise. Given the high-risk nature of this threat, affected individuals should also report the incident to relevant security teams for further investigation and mitigation.