metemaxkwallet[.]webflow[.]io

This domain, metemaxkwallet.webflow.io, is identified as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site mimics MetaMask’s official interface, presenting itself as a legitimate platform for cryptocurrency management under the page title 'Metamask Wallet: Simplifying Cryptocurrency Management with Confidence.' The intent appears to be credential harvesting or cryptocurrency theft, likely through a drainer kit designed to siphon funds from victims’ wallets upon interaction. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on May 08, 2013, though the phishing subdomain leverages Webflow’s hosting platform. It resolves to IP address 172.64.151.8, associated with Cloudflare, Inc. (AS13335) in the United States. The domain is flagged by 13 out of 95 security vendors on VirusTotal, with two additional blocklists (PhishDestroy and PhishingDB) listing it as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and fraudulent sites to evade basic detection. As of the latest assessment, metemaxkwallet.webflow.io has been taken offline, reducing immediate risk to users. However, the underlying infrastructure remains a concern, as similar subdomains or re-registration attempts may occur. Users are advised to verify domain authenticity before entering credentials and to monitor wallet activity for unauthorized transactions. Organizations should update blocklists to include this domain and related indicators to prevent future access attempts.