metamsask-extensiom[.]webflow[.]io

Analysis conducted on July 29, 2026 confirms that metamsask-extensiom.webflow.io is an active phishing domain targeting MetaMask users. The subdomain was registered on June 8, 2026 through Webflow, a legitimate platform frequently abused for hosting malicious content. As of the report date, the domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask's internal threat intelligence, and the SEAL anti-phishing consortium. VirusTotal scans reveal that 18 of 91 security vendors flag the domain as malicious, indicating broad consensus among detection engines regarding its fraudulent nature.

Infrastructure analysis reveals no associated IP address or autonomous system number in the available data, though the use of Webflow's hosting infrastructure is consistent with observed phishing campaigns that leverage free-tier services to evade takedowns. The domain's name, incorporating 'metamsask' and 'extension', strongly suggests an intent to deceive users into believing it is an official MetaMask browser extension or update portal. No page title, SSL certificate details, or HTTP response codes are provided in the current intelligence, limiting further technical assessment of the site's behavior. Defenders should treat this domain as high-risk and prioritize blocking it at the network and endpoint levels.

Organizations using Webflow for legitimate purposes are advised to monitor for unauthorized subdomains and implement stricter access controls to prevent abuse. Given the domain's active status and confirmed detections by multiple security vendors, users encountering this URL should avoid interaction and report it to their security teams or the relevant abuse contacts for Webflow. Further investigation into the domain's hosting configuration and any associated payment or command-and-control infrastructure is recommended to disrupt potential follow-on attacks.