metamaskkcrypt0login[.]webflow[.]io

This domain, metamaskkcrypt0login.webflow.io, is identified as a high-risk brand impersonation threat specifically targeting MetaMask users through fake login and crypto drainer pages. The domain is currently offline but was actively used to mimic MetaMask login interfaces, including pages titled 'metamask login', 'metamask sign in', and 'metamask login error'. Analysis indicates this was a deliberate attempt to harvest credentials and drain cryptocurrency wallets by exploiting the trust associated with the MetaMask brand. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., and resolved to the IP address 172.64.151.8. It was created on May 08, 2013, though recent malicious activity suggests compromise or repurposing of an older domain. The domain holds a Gridinsoft trust score of 0 out of 100 and is flagged by 17 of 95 security vendors on VirusTotal. Google Safe Browsing classified it under 'SOCIAL_ENGINEERING', and it appears on four distinct security blocklists. The SSL certificate is issued by Google Trust Services, which may have contributed to its perceived legitimacy despite malicious intent. The domain has been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and its associated IP at the network level. Users who accessed the site should immediately revoke any connected wallet sessions, change passwords, and scan systems for malware. Security teams should monitor for indicators of compromise, including the domain, IP, and related page titles, in logs and endpoint telemetry. Proactive measures such as phishing awareness training and multi-factor authentication enforcement are recommended to mitigate similar threats.