matemaskklugn[.]webflow[.]io

This domain, matemaskklugn.webflow.io, is flagged as a high-risk brand impersonation site designed to deceive users of the MetaMask cryptocurrency wallet. The site mimics MetaMask’s official login interface, likely aiming to harvest credentials or deploy crypto-draining malware. Visitors who enter sensitive information, such as seed phrases or private keys, risk immediate theft of digital assets, as the site’s infrastructure is optimized for rapid exfiltration of stolen data. Analysis indicates the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). VirusTotal reports 18 out of 95 security vendors have detected this domain as malicious, confirming its classification as a threat. The page title, 'MetaMask LȰgin: Protect Your Crypto Assets Today,' includes a non-standard Unicode character (LȰgin) to evade basic detection filters. Additionally, the domain appears on three security blocklists and is actively blocked by MetaMask’s internal threat intelligence systems. If you visited matemaskklugn.webflow.io and entered any credentials or wallet details, take immediate action. Disconnect any connected wallets from the site and revoke all active sessions. Transfer remaining assets to a new, secure wallet using a clean device. Scan the affected device for malware using updated security tools, and monitor all linked accounts for unauthorized transactions. Report the incident to MetaMask’s official support channels to assist in tracking the threat. Avoid reusing passwords or seed phrases across platforms to prevent further exposure.