metxmaskloges[.]webflow[.]io

This domain, metxmaskloges.webflow.io, poses a brand_impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet. The site presents a fraudulent login interface designed to deceive users into entering sensitive credentials, such as wallet recovery phrases or private keys. The page title, 'Metaɱask Login - Crÿptocurrency WalĮet,' employs Unicode characters to closely resemble the legitimate MetaMask branding, increasing the likelihood of successful deception. Analysis indicates this is a deliberate tactic to bypass basic visual scrutiny by users and automated detection systems. Evidence supporting the malicious nature of this domain includes detection by 14 out of 95 security vendors on VirusTotal, indicating a consensus among multiple threat intelligence sources. The domain was registered through MarkMonitor, Inc., a legitimate registrar, but the creation date of May 08, 2013, suggests the domain may have been repurposed or compromised, as it predates the current phishing campaign. Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8, hosted on Cloudflare's network (AS13335), a common obfuscation technique to mask the true origin of malicious content. Additionally, the domain appears on one security blocklist, further validating its classification as a threat. Users who have visited metxmaskloges.webflow.io or entered credentials on the site should take immediate action to mitigate potential risks. First, disconnect any active sessions or connected applications linked to the compromised credentials. Reset all passwords and recovery phrases associated with the MetaMask wallet or any other cryptocurrency services accessed during the suspected exposure. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor wallet transactions for unauthorized activity and consider transferring assets to a new wallet if suspicious transactions are detected. Report the incident to relevant security teams or platforms to contribute to broader threat intelligence efforts.