metamsk-nav-ext[.]wixstudio[.]com

The domain metamsk-nav-ext.wixstudio.com is identified as a high-risk phishing site targeting users of the MetaMask cryptocurrency wallet. Analysis indicates this domain was designed to impersonate the legitimate MetaMask platform, likely to harvest credentials or distribute malicious payloads. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used in a generic phishing campaign. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC, with a creation date of April 23, 2026, though this appears to be an anomalous or falsified record, as it predates the current date. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs technologies such as Wix, React, Google Cloud CDN, and HTTP/3. The domain is flagged by 17 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate is issued by Let’s Encrypt, a common feature in both legitimate and malicious domains. Current status confirms the domain is offline, though residual risk may persist for users who interacted with it prior to takedown. Organizations and individuals are advised to block the domain and its associated IP (34.144.206.118) at the network level. Users who may have visited the site should revoke any active sessions, reset credentials, and monitor accounts for unauthorized activity. Security teams should treat any prior engagement with this domain as a potential compromise and conduct forensic analysis where applicable.