meta-mask-template[.]webflow[.]io

This domain, meta-mask-template.webflow.io, is a confirmed brand impersonation site targeting MetaMask, a widely used cryptocurrency wallet. The site is designed to deceive users into believing they are interacting with the legitimate MetaMask platform, potentially leading to unauthorized access to wallet credentials, seed phrases, or direct cryptocurrency theft. Such impersonation attacks often employ convincing replicas of the official interface, including login prompts and transaction requests, to trick victims into disclosing sensitive information or approving malicious transactions. Analysis indicates this domain was flagged by 20 out of 95 security vendors on VirusTotal, confirming its malicious nature. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to the IP address 172.64.151.8, hosted on Cloudflare’s infrastructure (AS13335). The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently exploited by threat actors to lend false credibility to phishing sites. Additionally, the domain appears on three security blocklists and has been taken offline following detection by multiple threat intelligence platforms. If you visited meta-mask-template.webflow.io or interacted with its content, immediate action is required. Disconnect any devices used to access the site from the internet to prevent further exposure. Revoke any active wallet sessions or transaction approvals associated with the visit, and consider migrating funds to a new wallet if credentials or seed phrases were entered. Monitor connected accounts for unauthorized activity and report the incident to relevant cryptocurrency security teams for further investigation. Users should also verify the authenticity of any future MetaMask-related communications by cross-referencing official channels.