us-metamask-chrome[.]wixstudio[.]com

us-metamask-chrome.wixstudio.com is currently listed as an active crypto‑drainer infrastructure. The domain resolves to the public IPv4 address 34.144.206.118, which is hosted on Amazon Web Services infrastructure located in the us-east-1 region. No authoritative nameserver records are returned (NS_NOT_FOUND), indicating that the domain’s DNS delegation is either misconfigured or deliberately obscured. The domain appears on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering platforms, confirming a consensus view of malicious intent. VirusTotal analysis shows that eleven of ninety‑one scanned engines have flagged the domain for malicious behavior, reinforcing the blocklist evidence.

The primary malicious activity associated with this domain is a crypto‑drainer campaign targeting MetaMask users. The threat actor leverages the domain name to lure victims into authorizing fraudulent transactions, thereby siphoning cryptocurrency assets. The limited public data does not reveal a hosted web page title, SSL certificate details, or additional infrastructure such as C2 servers, leaving the full operational scope uncertain. Likewise, the absence of registrar information and registration timestamps hampers attribution efforts.

Defenders should treat any network traffic to or from 34.144.206.118 as potentially hostile. Immediate actions include adding the domain to DNS block lists, configuring proxy or firewall rules to deny HTTP/S requests, and monitoring endpoint logs for MetaMask transaction prompts that reference the domain. Security teams should also share the indicator set with threat‑intel sharing communities to improve collective detection. Ongoing surveillance of the IP address for new subdomains or related domains is advised, as the actor may pivot to adjacent infrastructure if current controls are evaded.