metamdasksldn[.]webflow[.]io

PhishDestroy has identified metamdasksldn.webflow.io as a confirmed phishing site engaged in brand impersonation, specifically targeting MetaMask users. The domain is currently offline, but its malicious intent was clearly established through multiple indicators. This site posed as an official MetaMask login page, attempting to steal user credentials and cryptocurrency wallet access.

The technical evidence against metamdasksldn.webflow.io is compelling. It was flagged by 13 out of 95 VirusTotal vendors as malicious, indicating broad consensus among security tools. The domain appeared on one security blocklist and was registered through MarkMonitor, Inc., with a creation date of May 08, 2013, which may have been used to lend an air of legitimacy. The site resolved to IP address 172.64.151.8 and used an SSL certificate from Google Trust Services / WE1. The page title, "Metamask® Login® - Log_In to My Account (official* Website)", was crafted to deceive users into believing they were accessing a legitimate MetaMask portal.

Given that the site is now offline, the immediate risk is reduced, but users who may have visited the domain before its takedown should take action. PhishDestroy recommends that anyone who entered their MetaMask credentials on metamdasksldn.webflow.io immediately change their passwords and enable two-factor authentication. Additionally, users should monitor their cryptocurrency wallets for unauthorized transactions and report any suspicious activity. Always verify URLs carefully before entering sensitive information, and rely on official channels to access MetaMask services.