metamvuask-wa-llet[.]webflow[.]io

This domain, metamvuask-wa-llet.webflow.io, is a confirmed brand impersonation threat targeting MetaMask users. The site replicates the official MetaMask wallet interface, presenting the page title 'MetaMask® Wallet - The crypto wallet for Defi, Web3 Dapps' to deceive visitors into entering sensitive credentials, such as seed phrases or private keys. Such impersonation attacks are designed to facilitate unauthorized access to cryptocurrency wallets, leading to potential financial loss and identity compromise. The domain's infrastructure and content are engineered to exploit trust in the MetaMask brand, a common tactic in cryptocurrency phishing campaigns. Analysis indicates the domain was registered on March 22, 2026, through Webflow, a platform often leveraged for rapid deployment of phishing sites. It resolves to the IP address 104.18.36.248, hosted by Cloudflare, Inc. in Canada, a provider frequently used to obfuscate malicious infrastructure. Security vendors have flagged the domain as malicious, with 19 out of 95 engines on VirusTotal detecting it as a threat. Additionally, the domain appears on three security blocklists, including those maintained by cryptocurrency security entities, further corroborating its malicious intent. Users who visited metamvuask-wa-llet.webflow.io should assume their credentials or sensitive information may have been compromised. Immediate actions include revoking access to any connected decentralized applications (dApps), transferring assets to a new wallet with a fresh seed phrase, and monitoring for unauthorized transactions. It is also recommended to review device security for potential malware infections, as phishing sites may distribute additional payloads. Affected individuals should report the incident to relevant security teams and consider enabling multi-factor authentication on all critical accounts to mitigate further risk.