lwgeinmettamck[.]webflow[.]io

The domain lwgeinmettamck.webflow.io was identified as a sophisticated brand impersonation site targeting MetaMask users. It presented a fraudulent login page designed to harvest cryptocurrency wallet credentials, posing a high risk of asset theft through a fake authentication flow. The site used bold Unicode text in its title to mimic the legitimate MetaMask interface, luring victims into entering sensitive information.

Technical analysis revealed alarming indicators: VirusTotal flagged it 14 out of 95 security vendors as malicious, and it appeared on one security blocklist. The domain was registered through MarkMonitor, Inc. and created on May 08, 2013, though it was likely repurposed for this campaign. Its SSL certificate from Google Trust Services / WE1 provided a false sense of security, while Google Safe Browsing explicitly labeled it as phishing. The domain resolved to IP 2606:4700:440c::ac40:9708, and although it is currently offline, users may have encountered it before takedown.

Anyone who visited this site should immediately change their MetaMask passwords and enable two-factor authentication. It is crucial to review any recent transactions and revoke permissions granted to suspicious dApps. PhishDestroy recommends always verifying URLs through official channels before entering credentials and using security tools like browser extensions that block known phishing domains. Users should report any fraudulent activity to relevant authorities and the MetaMask support team to prevent further exploitation.