mettamsklugins[.]webflow[.]io

This domain, mettamsklugins.webflow.io, is confirmed as a high-risk credential harvesting site targeting MetaMask wallet users. Analysis indicates the site impersonates the legitimate MetaMask login interface, using Unicode obfuscation in the page title (M͎e͎t͎a͎M͎a͎s͎k͎® Łøg͎i͎n͎) to evade basic detection mechanisms. The threat type is classified as a cryptocurrency wallet phishing page, designed to capture seed phrases, private keys, or login credentials under the pretense of DeFi or Web3 application access. No specific drainer kit signatures were identified in initial scans, but the infrastructure aligns with known MetaMask-themed credential harvesting campaigns observed in Q1 2026. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 30, 2026, through Webflow’s hosting platform and resolves to IP address 172.64.151.8, geolocated to a Cloudflare, Inc. node in California. VirusTotal detection ratio stands at 17/95 security vendors flagging the domain as malicious, while Google Safe Browsing status remains unconfirmed in available datasets. The domain appears on three independent security blocklists, including sector-specific threat intelligence feeds. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s reverse proxy services. Current status of mettamsklugins.webflow.io is offline, though residual risk persists due to the domain’s recent creation date and the transient nature of phishing infrastructure. Response actions include takedown requests submitted to Webflow and Cloudflare, as well as community-driven blocklist updates. Users who interacted with the domain prior to its deactivation are advised to immediately revoke any connected wallet sessions, rotate credentials, and audit transaction histories for unauthorized activity. Persistent monitoring of associated IP ranges (172.64.0.0/13) is recommended, as threat actors frequently redeploy phishing pages on adjacent infrastructure following initial takedowns.