metamesklgi[.]webflow[.]io

This domain, metamesklgi.webflow.io, is identified as a high-risk threat due to its brand impersonation of MetaMask. The site purportedly mimics the appearance and functionality of the legitimate MetaMask login page, aimed at deceiving users into providing sensitive information, such as their login credentials or private keys. This type of threat is particularly concerning due to its potential to result in unauthorized access to users' crypto wallets, leading to financial loss.

Analysis of the domain reveals several indicators of malicious intent. It was registered on February 21, 2026, through NameCheap, Inc., a common choice for quick and anonymous domain registrations. The domain is hosted on an IP address 172.64.151.8, associated with AS13335 Cloudflare, Inc. Security analysis from VirusTotal shows that 20 out of 95 security vendors have flagged this domain, further supporting the assessment of its risk level. Moreover, the domain's SSL certificate was issued by Google Trust Services, which does not automatically indicate legitimacy, as certificates can be acquired by malicious actors to provide a false sense of security.

If someone has visited metamesklgi.webflow.io, it is crucial to take immediate action. Users should first ensure that any credentials entered on the site are changed on the legitimate MetaMask platform without delay. Additionally, they should monitor their crypto wallets for unauthorized transactions and consider enabling additional security measures such as two-factor authentication. Reporting the incident to relevant security services and checking for other signs of compromise on their devices is also recommended. Users should stay informed about the latest phishing tactics and regularly review security settings to protect their assets effectively.