metaamaskcrypt0login[.]webflow[.]io

This domain, metaamaskcrypt0login.webflow.io, is identified as a credential phishing site specifically targeting users of the MetaMask cryptocurrency wallet. Analysis indicates the domain is designed to harvest login credentials by presenting a fraudulent interface resembling the legitimate MetaMask authentication portal. No specific drainer kit has been conclusively linked to this domain, but its infrastructure and naming convention align with known phishing campaigns targeting decentralized finance platforms. Infrastructure analysis reveals the domain resolves to the IP address 172.64.151.8 and was registered through MarkMonitor, Inc. on May 08, 2013. Despite its long registration history, the domain is currently flagged by 7 out of 95 security vendors on VirusTotal, indicating malicious activity. Google Safe Browsing classifies this domain under the SOCIAL_ENGINEERING category, confirming its use in deceptive practices. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy to unsuspecting users. As of the latest assessment, metaamaskcrypt0login.webflow.io remains active and poses a high risk to users who may inadvertently disclose sensitive credentials. Immediate response actions include blacklisting the domain across security gateways, notifying the hosting provider (Webflow) for takedown, and alerting cryptocurrency communities to prevent further compromise. The remaining risk is significant due to the domain's active status and the potential for credential theft leading to unauthorized access to digital assets. Users are advised to verify domain authenticity before entering credentials and to enable multi-factor authentication on all cryptocurrency wallets.