metmakhlogi[.]webflow[.]io

This domain, metmakhlogi.webflow.io, was identified as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. The site mimics the official MetaMask login page, presenting itself as a gateway to decentralized applications (Dapps) with the page title 'MetaMask Login : Access Decentralized Applications (Dapps)'. Users tricked into entering credentials on this site risk having their wallet credentials stolen, leading to unauthorized access and potential financial loss. The threat is particularly severe for individuals involved in cryptocurrency transactions, as compromised wallets can result in irreversible asset theft. Analysis indicates this domain was created on May 8, 2013, though the malicious activity associated with it is recent. The domain is registered through MarkMonitor, Inc., a registrar commonly used for legitimate and illegitimate purposes alike. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). Security vendors have flagged this domain, with 15 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, further confirming its fraudulent nature. If you visited metmakhlogi.webflow.io and entered any credentials or sensitive information, immediate action is required. First, disconnect any connected devices from the internet to prevent further data exfiltration. Next, assume the credentials entered are compromised and revoke access to any associated cryptocurrency wallets or accounts. Replace the credentials with strong, unique passwords and enable multi-factor authentication where available. Monitor all linked accounts for unauthorized transactions or activity. If financial loss has occurred, report the incident to relevant authorities and consider contacting the platform’s support team for further assistance. Users should also scan their devices for malware, as phishing sites may deploy additional payloads.