metamaskwallet-fixed[.]webflow[.]io

PhishDestroy identifies the domain metamaskwallet-fixed.webflow.io as an active brand impersonation site targeting MetaMask users. This fraudulent infrastructure leverages the trusted MetaMask brand to deceive victims into exposing wallet credentials or approving unauthorized cryptocurrency transactions. The domain employs a Webflow.io subdomain to appear legitimate, while the path component (“fixed”) suggests a fabricated “update” or “fix” narrative commonly used in crypto drainer campaigns. No known drainer kit artifacts are publicly available, but the site’s behavior aligns with credential theft and transaction manipulation typical of wallet impersonation campaigns.

Technical analysis reveals multiple red flags. The domain resolves to IP address 172.64.151.8 and uses a Google Trust Services SSL certificate. It was launched recently and remains unindexed by Google Safe Browsing (GSB status: clean). However, it has been blocked by MetaMask’s official blocklist and SEAL threat intelligence network. VirusTotal detection stands at 6 out of 95 security vendors, indicating moderate but significant recognition as malicious. The domain is listed on two independent security blocklists, reinforcing its hostile classification. Registrar data indicates recent creation, though full WHOIS privacy masking is in use, obfuscating ownership details.

This domain remains active and poses an elevated risk to uninformed users. MetaMask and SEAL have implemented network-level blocks, preventing most direct access attempts. However, the site may persist in phishing emails, social media promotions, or fake support channels. Users are advised to verify all wallet-related links via official MetaMask channels, avoid entering credentials on untrusted pages, and report suspicious domains to MetaMask security teams. The remaining risk is moderate due to active takedown efforts and public awareness, but the domain’s recent creation and impersonation tactics warrant continued vigilance.