xn--metamasklogin-lobs[.]webflow[.]io

This domain, xn--metamasklogin-lobs.webflow.io, operates as a high-risk brand impersonation portal targeting MetaMask users. The site presents a fraudulent login interface designed to harvest cryptocurrency wallet credentials, likely leading to unauthorized asset transfers or crypto draining attacks. The page title, 'ḾeṫaMask Login | A crypto wallet & gateway to blockchain apps | ḾetaMask,' mimics the legitimate MetaMask branding, including subtle Unicode character substitutions to evade detection by casual users and basic security filters. Analysis indicates the domain was registered on May 8, 2013, though the malicious activity appears recent, leveraging an older registration to lend false legitimacy. The domain resolves to IP address 104.18.36.248 and is hosted behind Cloudflare, utilizing HTTP/3 for content delivery. VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious, with Google Safe Browsing specifically categorizing it under 'SOCIAL_ENGINEERING.' The domain is currently listed on three security blocklists and has been blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, further complicating user discernment of its illegitimacy. The registrar, MarkMonitor Inc., is a common choice for both legitimate and malicious domains due to its enterprise-grade services. Users who have visited xn--metamasklogin-lobs.webflow.io should assume their wallet credentials or recovery phrases may be compromised. Immediate actions include revoking any connected sessions from the legitimate MetaMask interface, transferring assets to a new wallet with a fresh seed phrase, and monitoring transaction histories for unauthorized activity. If credentials were entered, users should treat all linked accounts as compromised and conduct a full security audit. Browser data, including cookies and cached files, should be cleared to eliminate residual tracking mechanisms. Additionally, users are advised to report the domain to their security software providers and relevant threat intelligence platforms to aid in broader mitigation efforts.