metmaskchromeext[.]my[.]canva[.]site

The domain metmaskchromeext.my.canva.site was identified as a brand‑impersonation site targeting MetaMask, with an elevated risk rating. Registration data shows the domain was created on April 03, 2018 through Gandi SAS, and it resolves to the IP address 103.169.142.6, which is associated with AS209242 Cloudflare London, LLC in Australia. DNS resolution uses the Cloudflare nameservers jean.ns.cloudflare.com and junade.ns.cloudflare.com, and the site serves a Google Trust Services certificate (WE1) over HTTP/3. A request to the host returns an HTTP 404 status, indicating the content is currently unavailable; the site is listed as offline in the latest intelligence.

VirusTotal analysis recorded 11 detections out of 95 scanned security vendors, and the domain appears on one external blocklist. PhishDestroy has already blocked the host. The page title retrieved from the site reads "Download Metamask Chrome Extension | Official Site," confirming the intent to masquerade as an official MetaMask extension download page. The observed indicators—Cloudflare infrastructure, a Google‑issued TLS certificate, and the use of a plausible page title—are consistent with a crypto‑scam delivery model, although the exact payload or phishing flow has not been captured.

Because the site is presently offline, definitive assessment of the malicious page content remains uncertain. Defenders should continue to block the domain and its resolving IP, monitor for re‑activation, and add the host to URL filtering and endpoint protection rules. Additional surveillance of newly registered subdomains under the *.my.canva.site namespace is advisable, as the pattern suggests reuse of legitimate‑looking branding to lure cryptocurrency users. Organizations that rely on MetaMask should educate users about the official extension distribution channels and reinforce verification of TLS certificates and URL paths before downloading any extension.