meta-io-mask[.]wixstudio[.]com

This domain is flagged for elevated-risk brand impersonation targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the threat type is a fake login portal designed to harvest credentials or facilitate unauthorized transactions, as evidenced by the page title 'Log In | MetaMask™' and the use of MetaMask branding elements. The domain exhibits characteristics consistent with credential theft or crypto drainer schemes, where victims are tricked into entering sensitive information on fraudulent interfaces. Infrastructure analysis reveals the domain meta-io-mask.wixstudio.com resolves to IP address 34.144.206.118, hosted on Google Cloud infrastructure. It is registered through GoDaddy.com, LLC, and secured with a Let's Encrypt SSL certificate. The domain is detected by 6 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on 5 security blocklists, including MetaMask’s internal filtering systems. Technologies detected include Wix, React, Lodash, HSTS, Google Cloud CDN, and HTTP/3, suggesting a modern, cloud-based hosting environment. No creation date is provided, but the domain is currently offline, likely due to takedown efforts. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (34.144.206.118) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint into security monitoring tools to detect potential access attempts. End-users should be educated on verifying domain authenticity before entering credentials, particularly for cryptocurrency services. Multi-factor authentication (MFA) should be enforced for all wallet access to reduce the impact of credential theft. Given the elevated risk, incident response teams should review logs for any prior interactions with this domain or its infrastructure to identify potential compromise.