metaamasklugn[.]webflow[.]io

This domain, metaamasklugn.webflow.io, is identified as a high-risk crypto drainer phishing site specifically designed to impersonate MetaMask, a widely used cryptocurrency wallet service. The site is currently offline, but prior analysis confirms its malicious intent to deceive users into disclosing sensitive credentials or authorizing fraudulent transactions, leading to unauthorized asset transfers. Infrastructure analysis reveals the domain was flagged by 16 of 95 security vendors on VirusTotal, indicating broad detection of its malicious nature. It was registered through NameCheap, Inc. on February 21, 2026, and resolved to the IP address 172.64.151.8. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). Google Safe Browsing has explicitly flagged this domain as phishing, reinforcing its classification as a threat. Given its current offline status, the immediate risk of interaction is reduced; however, users should remain vigilant. It is recommended to verify wallet addresses independently, avoid clicking on unsolicited links, and monitor account activity for unauthorized transactions. Security teams should update blocklists to include this domain and its associated indicators to prevent future exposure.