metiiimask-extensio[.]webflow[.]io

The domain metiiimask-extensio.webflow.io is identified as a confirmed fraudulent site specializing in brand impersonation, specifically targeting MetaMask, a widely used cryptocurrency wallet browser extension. Analysis indicates this domain is designed to deceive users into believing they are downloading or interacting with legitimate MetaMask software, thereby facilitating credential theft, unauthorized transactions, or malware deployment. The site is currently offline, but its prior activity poses significant risks to unsuspecting users. Infrastructure analysis reveals critical technical indicators supporting this assessment. The domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flagged the domain as malicious, with 20 out of 95 engines detecting threats. It appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain’s fraudulent nature, as attackers frequently exploit valid certificates to lend credibility to phishing sites. The page title, 'MetaMask® Extension - Browser extension - webflow,' further confirms the intent to impersonate the legitimate MetaMask brand. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure and historical activity remain a concern. Users who may have interacted with this domain should immediately revoke any associated permissions, reset credentials, and scan systems for malware. Organizations are advised to update blocklists with the domain and IP address (104.18.36.248) to prevent future access. Monitoring for similar domains using the same registrar (NameCheap, Inc.) or hosting provider (Cloudflare) is recommended to mitigate recurring threats. Proactive measures, including user education on recognizing brand impersonation tactics, are essential to reducing exposure to such fraudulent schemes.