metsmask-wallet-ix[.]webflow[.]io

The domain metsmask-wallet-ix.webflow.io was registered through NameCheap on 22 February 2026 and is hosted behind Cloudflare (ASN 13335, United States). The site presented the page title “MetaMask® Wallet – The crypto wallet for Defi, Web3 Dapps”, directly referencing the MetaMask brand, and is classified as a crypto‑scam impersonating MetaMask. An SSL certificate issued by Google Trust Services (WE1) was observed, indicating HTTPS encryption but offering no validation of the underlying content. HTTP probing returned a 404 status, and the domain is currently taken offline, suggesting the phishing infrastructure has been removed or is temporarily inactive. Reputation data show the domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask’s own protection list, and SEAL.

VirusTotal scans recorded 19 of 95 antivirus engines flagging the domain as malicious, reinforcing the high‑risk assessment. The hosting environment disclosed HTTP/3 support, a modern protocol often leveraged by threat actors to improve performance and evade detection. The resolved IP address 172.64.151.8 belongs to Cloudflare’s network in the United States, providing only the protection of the CDN without revealing the true backend server. Defenders should treat any traffic to this host as hostile.

Immediate actions include adding the domain to local deny lists, updating web‑filtering rules, and ensuring that endpoint protection solutions incorporate the blocklist entries. Because the site is presently offline, monitoring for re‑registration or the appearance of similar sub‑domains on the same registrar or CDN is advisable. Continuous review of VirusTotal and other threat‑intel feeds for new detections will help maintain visibility. Organizations that rely on MetaMask should educate users about the legitimate URL structure and encourage verification of SSL certificates, especially given that legitimate MetaMask resources are not hosted on webflow.io domains.