apps-metamassk-io[.]wixstudio[.]com

The domain apps-metamassk-io.wixstudio.com has been identified as a high-risk credential phishing site specifically targeting MetaMask users. Analysis confirms this domain engages in brand impersonation, presenting a fraudulent login interface under the page title 'Log In™ | MetaMask® Web Apps' to deceive victims into submitting sensitive wallet credentials. As of the latest verification, the domain has been taken offline, though prior activity remains a documented threat. Infrastructure analysis reveals the domain was flagged by 15 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. The domain was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, a Google Cloud-hosted endpoint. It appears on five security blocklists, including MetaMask’s own internal filtering systems, PhishDestroy, PhishingArmy, SEAL, and OISD. The SSL certificate is issued by Let’s Encrypt, a common feature in both legitimate and malicious sites. Detected technologies include Wix hosting, React framework, Google Cloud infrastructure, Lodash, HSTS enforcement, and HTTP/3 protocol support. Gridinsoft’s trust scoring system assigned the domain a score of 0 out of 100, further corroborating its malicious classification. Current status indicates the domain is offline, though residual risk remains for users who may have interacted with it prior to takedown. Organizations and individuals are advised to block the domain and its associated IP at the network level. Users who accessed the site should assume credential compromise and immediately rotate any exposed passwords or cryptographic keys. Wallet holders should transfer assets to new addresses and enable multi-factor authentication where available. Security teams are encouraged to monitor for similar impersonation patterns involving Wix-hosted subdomains with cryptocurrency branding, particularly those using Let’s Encrypt certificates and resolving to cloud providers.