mettmaskewallet[.]webflow[.]io

The domain mettmaskewallet.webflow.io is actively targeting MetaMask users with phishing tactics. It is flagged as malicious by 9 out of 91 vendors on VirusTotal, indicating significant recognition of its threat potential. The domain is also listed on four public blocklists, including those maintained by PhishDestroy and MetaMask itself, highlighting its specific focus on deceiving users of this cryptocurrency wallet.

Registered through MarkMonitor, Inc., and hosted on IP address 172.64.151.8 by Cloudflare, Inc., this domain leverages the reputable infrastructure to lend an appearance of legitimacy. Despite being created in 2013, it was first detected as a threat by PhishDestroy on June 22, 2026, suggesting recent activity aimed at exploiting MetaMask users. Google Safe Browsing also flags this domain, further underscoring its malicious intent.

The SSL certificate issued by Google Trust Services provides an additional layer of deception, potentially misleading users into believing they are interacting with a secure and legitimate site. With a platform risk score of 100 out of 100, mettmaskewallet.webflow.io represents a high-risk entity in the digital landscape. Its presence on multiple blocklists and active status necessitate immediate attention from users to avoid potential compromise of sensitive information.