micro-metamask[.]wixstudio[.]com

Analysis of micro-metamask.wixstudio.com confirms its classification as a high-risk crypto drainer domain, active as of July 29, 2026. The domain was registered on June 8, 2026, through Wix Studio, a platform frequently exploited for hosting malicious pages due to its accessibility and low friction for threat actors. Detection data indicates the domain is flagged by 14 of 91 security vendors on VirusTotal, a significant outlier for newly registered infrastructure. It also appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, which specialize in tracking cryptocurrency-related threats. The inclusion by MetaMask, a primary target of such drainers, suggests a direct attempt to compromise wallet connections or seed phrases.

Infrastructure analysis reveals the domain is hosted on Wix Studio’s content delivery network, a common pattern for low-cost, disposable phishing or scam sites. No IP address or autonomous system number (ASN) is currently associated with the domain in public threat feeds, limiting attribution to specific hosting providers or geolocations. The domain’s HTTP status, SSL certificate validity, and page content have not been fully analyzed, though the page title and exact functionality remain unconfirmed. The unique seed identifier 4a7d7c is linked to this investigation but provides no additional forensic context beyond correlation.

Defenders should treat this domain as actively malicious. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or wallet integrations. Endpoint protection should be updated to include this domain in denylists, and users should be alerted to avoid interacting with any site under the micro-metamask.wixstudio.com subdomain. Further monitoring is advised to track potential shifts in hosting or redirection tactics, as threat actors frequently rotate infrastructure to evade detection.