metamaskloginjn[.]webflow[.]io

metamaskloginjn.webflow.io has been confirmed as an active brand impersonation site targeting MetaMask users. The threat involves a fraudulent Webflow subdomain designed to harvest credentials or seed phrases under the guise of a legitimate login portal. No crypto drainer kit has been observed in this campaign; the attack vector relies on social engineering and domain spoofing rather than malicious contract deployment.

PhishDestroy identifies this domain as resolving to IP 172.64.151.8, hosted on Cloudflare infrastructure. The domain was registered through Google Domains and leverages a Google Trust Services SSL certificate to enhance legitimacy. VirusTotal analysis shows 15 out of 95 security vendors flagged this domain for malicious activity. It has been observed on two public blocklists, including Phishunt and OpenPhish, and is currently categorized in Google Safe Browsing (GSB) as a phishing resource.

This domain remains active and poses an elevated risk to cryptocurrency users seeking MetaMask access. Immediate user action includes avoiding the domain entirely and reporting it via browser safety tools. Organizations should update threat intelligence feeds and endpoint protections to block metamaskloginjn.webflow.io and its associated IP. While current detections are moderate, the lack of complex drainer infrastructure suggests potential for rapid expansion. Users are advised to verify access points only via official MetaMask domains and enable multi-factor authentication where applicable.