metamaksextnsion[.]webflow[.]io

The domain metamaksextnsion.webflow.io is currently active and assigned an elevated risk rating. Registration data indicates the site was created using the Webflow platform, a SaaS website builder that provides shared hosting and CDN services. No additional registrar details are supplied. VirusTotal has processed the domain and 13 of 91 antivirus and URL scanning engines returned a malicious classification, confirming that multiple independent tools have identified phishing-related behavior.

The domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy filtering service, demonstrating that at least one operational anti-phishing feed is already curating this indicator. No public Safe Browsing, Open Threat Exchange, or SSL certificate information is available in the shared intelligence, and the page title has not been disclosed, so the exact content served by the site remains unknown. The limited visibility suggests the infrastructure may be leveraging Webflow’s generic hosting environment to obscure the attacker’s location and to benefit from the platform’s reputation. Defenders should immediately add metamaksextnsion.webflow.io to local deny lists, enforce DNS-based blocking, and monitor outbound requests for connections to Webflow-owned IP ranges.

Email gateways should be updated to flag any messages containing links to this domain, and security teams should correlate internal logs for recent access attempts. Continued observation of VirusTotal and blocklist updates is recommended, as additional detections may surface if the threat actor expands the campaign. The internal seed identifier bbae14 can be used for tracking this indicator across incident response tools.