mertamasjkogin[.]webflow[.]io

This domain, mertamasjkogin.webflow.io, is a confirmed brand impersonation threat targeting MetaMask users. The site mimics the legitimate MetaMask wallet interface to deceive victims into entering sensitive credentials, including private keys or recovery phrases. Successful compromise would enable attackers to drain cryptocurrency assets from connected wallets, a tactic known as a crypto drainer attack. The page title 'mertamasjkogin' and the absence of official MetaMask branding elements further indicate malicious intent, as legitimate services use consistent naming conventions. Analysis of the domain infrastructure reveals multiple high-confidence indicators of compromise. The domain is flagged by 19 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. It appears on two independent security blocklists, PhishDestroy and PhishingDB, and is explicitly labeled as phishing by Google Safe Browsing. The domain was registered through MarkMonitor, Inc. on May 8, 2013, though the current malicious activity suggests recent compromise or repurposing. It resolves to IP address 104.18.36.248, hosted on Cloudflare's network (AS13335), and uses an SSL certificate issued by Google Trust Services (WE1), which does not validate legitimacy. Users who visited mertamasjkogin.webflow.io should assume their MetaMask credentials or recovery phrases may have been exposed. Immediately revoke access to any connected wallets and transfer assets to a new, secure wallet. Check browser extensions and installed applications for unauthorized modifications, as some crypto drainers deploy additional payloads. Monitor transaction histories for unauthorized transfers and report the incident to relevant blockchain explorers or security teams. Do not reuse passwords or recovery phrases from compromised sessions, and enable multi-factor authentication where available to mitigate further risk.