mettamassksiggnin[.]webflow[.]io

This domain, mettamassksiggnin.webflow.io, poses as a legitimate MetaMask login portal to deceive users into entering sensitive wallet credentials. The site mimics the official MetaMask interface, displaying page titles such as 'metamask login,' 'metamask sign in,' and 'metamask login error' to create a false sense of urgency or technical difficulty. Such impersonation is a common tactic in credential-harvesting campaigns targeting cryptocurrency users, where stolen login details can lead to unauthorized access and financial theft. Analysis indicates that mettamassksiggnin.webflow.io was originally created on May 8, 2013, and registered through MarkMonitor, Inc., a domain registrar commonly used for legitimate corporate domains. However, the domain has since been repurposed for malicious activity, as evidenced by its detection by 19 out of 95 security vendors on VirusTotal. The site resolves to the IPv6 address 2606:4700:440c::ac40:9708, hosted on Cloudflare’s network (AS13335) in the United States. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, further confirming its malicious intent. Users who may have interacted with mettamassksiggnin.webflow.io should take immediate action to mitigate potential risks. First, cease all interaction with the domain and avoid entering any credentials. If login details were submitted, revoke access to the MetaMask wallet from all connected applications and devices, then transfer any remaining assets to a new, secure wallet. Enable multi-factor authentication on all accounts where possible and monitor for unauthorized transactions. It is also recommended to scan the device used to access the site for malware, as phishing pages may deploy additional payloads to compromise systems further.