metamaskwalletxtensioeno[.]webflow[.]io

This domain, metamaskwalletxtensioeno.webflow.io, has been observed in a single security blocklist and is actively blocked by the PhishDestroy service. Registration information indicates the domain was created through Webflow, Inc., a platform that provides hosting and site‑building services. The domain does not resolve via standard authoritative nameservers; a lookup returned NS_NOT_FOUND, suggesting the nameserver records are either missing or obscured. DNS resolution points to the IP address 104.18.36.248, which belongs to a content‑delivery network commonly used for legitimate web traffic.

The domain was submitted to VirusTotal where 91 antivirus and URL‑reputation engines analyzed the URL; none of the engines generated a detection at the time of scanning. Although the lack of detections does not imply safety, it indicates that the payload or page content has not yet been flagged by the majority of public scanners. The threat classification supplied is “crypto drainer,” implying that the site may attempt to harvest cryptocurrency credentials or redirect users to malicious wallet interfaces. No additional telemetry such as SSL certificate details, HTTP response codes, page title, or content snapshots is available, leaving the exact malicious behavior unverified.

Analysts should treat the domain as potentially hostile and incorporate it into blocklists, firewall deny rules, and endpoint web‑filter policies. Continuous monitoring of the IP address and any future VirusTotal or threat‑intel submissions is recommended to detect possible changes in behavior. Because the registrar is a reputable SaaS provider, takedown requests may be routed through Webflow’s abuse channel if sufficient evidence of wrongdoing is gathered.