web-metamask-io-docs[.]my[.]canva[.]site

The domain web-metamask-io-docs.my.canva.site is currently taken offline and returns an HTTP 404 response. Registration records indicate it was created on 3 April 2018 through the Gandi SAS registrar. The authoritative name servers are jean.ns.cloudflare.com and junade.ns.cloudflare.com, and the domain resolves to the IP address 103.169.142.250, which belongs to Cloudflare’s AS209242 infrastructure located in Australia. TLS termination is provided by a Google Trust Services certificate issued for the WE1 entity, confirming use of a legitimate certificate chain.

Security monitoring shows the domain appears on a single blocklist and is listed by PhishDestroy as a malicious site. VirusTotal analysis reports that eight of ninety‑five scanning engines flag the domain as suspicious, reinforcing the suspicion despite the current offline state. The site is classified as a crypto‑related scam and actively impersonates the MetaMask brand. No page title could be retrieved, and the only visible technology fingerprints are Cloudflare services and HTTP/3 support.

Because the domain is inactive, immediate traffic blocking may have limited impact, but defenders should add the host to internal deny lists, monitor for any future re‑activation, and ensure that any outbound connections to the associated IP address are logged and inspected. Continuous vigilance is advised, especially for users handling cryptocurrency wallets, as the domain’s prior behavior suggests it was used to lure MetaMask users into credential‑ harvesting or fund‑draining schemes. Further investigation should include reviewing historical snapshots, if available, and correlating any internal alerts that reference the domain or its IP with known phishing campaigns targeting MetaMask users.