metamaaskelogiine[.]webflow[.]io

PhishDestroy identifies metamaaskelogiine.webflow.io as an active MetaMask brand impersonation domain, leveraging a counterfeit login portal to harvest credentials. The threat is classified as high-risk due to explicit mimicking of MetaMask’s branding and interface, with the page title mirroring the legitimate ‘Login | MetaMask’ title. This domain exploits user trust in recognizable interfaces to deploy credential phishing, a tactic commonly associated with cryptocurrency wallet theft. The seed hash c1108f confirms this threat’s uniqueness in the database.

This domain was flagged with 0 detections out of 95 on VirusTotal, indicating undetected malicious activity as of the latest scan. It resolves to IP address 172.64.151.8 and operates under Google Trust Services’ SSL certificate, which does not guarantee legitimacy in this context. The domain uses the Webflow.io platform, a legitimate hosting service, to host the phishing content—demonstrating abuse of reputable infrastructure. No current blocklist entries were detected, and full telemetry remains under active investigation. The impersonation of MetaMask, a leading cryptocurrency wallet, amplifies the risk potential due to the high-value nature of wallet credentials and the likelihood of user interaction.

To mitigate exposure to this specific brand impersonation threat, users must verify domain spellings and HTTPS certificates manually, especially when accessing financial platforms. Never enter credentials on sites reached via third-party links or ads. Enterprises should deploy real-time domain reputation checks and browser extensions that compare URLs against known phishing databases using threat intelligence feeds. Report suspected impersonation domains immediately to MetaMask’s official security channels and update security awareness training to highlight visual spoofing tactics.