extension-metamasks[.]webflow[.]io

This domain, extension-metamasks.webflow.io, operates as a fraudulent credential harvesting site targeting users of the MetaMask cryptocurrency wallet. The site mimics legitimate MetaMask interfaces to deceive visitors into entering sensitive information such as seed phrases, private keys, or wallet passwords. Once obtained, this information allows attackers to gain unauthorized access to victims' digital assets, leading to potential financial loss and identity compromise. The threat primarily exploits user trust in the MetaMask brand and urgency tactics, such as fake security alerts or account verification prompts, to coerce victims into disclosing credentials. Analysis indicates this domain is a high-risk threat with substantial technical evidence supporting its malicious nature. The domain was registered on February 21, 2026, through NameCheap, Inc., and is hosted on infrastructure associated with Cloudflare, Inc. (AS13335). It resolves to the IP address 172.64.151.8, located in the United States. Security vendors on VirusTotal flagged the domain as malicious, with 19 out of 95 engines detecting it as a phishing site. Additionally, the domain appears on three security blocklists and is explicitly blocked by MetaMask and other industry-specific threat intelligence sources. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. Users who visited extension-metamasks.webflow.io or entered credentials on the site should take immediate action to mitigate potential damage. First, disconnect any devices used to access the site from the internet to prevent further data exfiltration. Next, assume all entered credentials are compromised and revoke access to any associated MetaMask or cryptocurrency wallets. Generate new seed phrases and private keys, and transfer remaining assets to a new, secure wallet. Monitor all linked accounts, including email and exchange platforms, for unauthorized activity. Enable multi-factor authentication (MFA) where available, and report the incident to relevant financial or cryptocurrency platforms. Finally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads to maintain persistence or exfiltrate data.