metasmhkloin[.]webflow[.]io

This domain, metasmhkloin.webflow.io, is flagged as an elevated-risk impersonation site targeting users of the MetaMask cryptocurrency wallet. The site mimics legitimate MetaMask interfaces to deceive visitors into entering sensitive credentials, such as recovery phrases or private keys. Successful compromise would enable attackers to gain unauthorized access to victims' digital assets, leading to potential financial loss and identity fraud. The threat is classified as brand impersonation, a tactic commonly used to exploit trust in well-known services for malicious purposes. Analysis indicates the domain was registered through MarkMonitor, Inc. on May 8, 2013, though the phishing content appears to have been deployed more recently. It resolves to the IPv6 address 2606:4700:440c::ac40:9708, associated with Cloudflare, Inc. (AS13335) in the United States. The SSL certificate is issued by Google Trust Services under the WE1 root, a common configuration for legitimate and malicious sites alike. Detection metrics reveal the domain is flagged by 19 out of 95 security vendors on VirusTotal and appears on two independent security blocklists, including PhishDestroy and PhishingDB. The page title, 'metasmhkloin,' further deviates from legitimate MetaMask branding, reinforcing its fraudulent nature. Users who visited metasmhkloin.webflow.io should assume their credentials or recovery phrases may have been exposed. Immediate action is required: revoke any active sessions linked to the site, transfer assets to a new, secure wallet, and enable multi-factor authentication on all associated accounts. Monitor transaction histories for unauthorized activity and report the incident to relevant financial or blockchain security teams. Avoid interacting with unsolicited links or pop-ups claiming affiliation with MetaMask, and verify domain authenticity through official channels before entering sensitive information.