metamak-ext[.]wixstudio[.]com

PhishDestroy identifies metamak-ext.wixstudio.com as a live crypto drainer posing as the MetaMask wallet interface. The domain leverages a WixStudio subdomain to mimic legitimate MetaMask access pages, tricking users into connecting their crypto wallets and authorizing malicious transactions. Security teams should block this domain at the network level and warn employees handling cryptocurrency operations. The site currently remains undetected by most antivirus engines, making it a stealthy threat to watch. The domain resolves to 34.144.206.118, a Google Cloud IP address, and holds a valid Let’s Encrypt SSL certificate, adding a false sense of legitimacy. This domain was flagged for generic phishing behavior, specifically targeting crypto users with wallet drainer tactics. VirusTotal currently shows 0 detections out of 95 security vendors, indicating it has not yet been widely blacklisted. The domain was registered through Wix.com as a WixStudio subdomain, which allows threat actors to rapidly deploy phishing pages under a trusted hosting provider. While the exact creation date is not available in the current feed, the domain remains active and continues to serve malicious content without triggering most endpoint protections. If you or anyone in your organization has visited this site, do not interact with any wallet connection prompts or transaction approvals. Disconnect from the network immediately and revoke any unauthorized wallet connections through your wallet’s connected app management section. Run a full antivirus scan and check for unauthorized outbound connections. Report the domain to your security team and block both the domain and IP address (34.144.206.118) across all security controls. Consider rotating wallet credentials and monitoring on-chain activity for suspicious transactions.