meta-mask-io[.]wixstudio[.]com

The domain meta-mask-io.wixstudio.com is identified as a high-risk brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet service. As of the latest assessment, the domain has been taken offline, though it previously hosted content designed to deceive users into believing it was an official MetaMask platform. This type of threat typically aims to harvest sensitive credentials, private keys, or facilitate unauthorized transactions, posing significant financial and security risks to victims. Analysis of the domain reveals multiple technical indicators confirming its malicious nature. The domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. It was flagged by 17 out of 95 security vendors on VirusTotal, indicating broad consensus among cybersecurity entities regarding its fraudulent intent. Additionally, the domain appeared on three security blocklists and was actively blocked by MetaMask, PhishDestroy, and SEAL. The Gridinsoft trust score for this domain is 0 out of 100, further corroborating its classification as a malicious entity. Detected technologies include Wix, React, Google Cloud, Google Cloud CDN, and HTTP/3, with a Let's Encrypt SSL certificate, which, while common among legitimate sites, is frequently exploited by threat actors to lend a false sense of legitimacy. Currently, meta-mask-io.wixstudio.com returns a 404 error page hosted on Wix Studio, suggesting the malicious content has been removed or the domain has been suspended. However, users who may have interacted with the domain prior to its takedown should take immediate action. It is recommended to revoke any permissions granted to suspicious applications or browser extensions, reset passwords, and review transaction histories for unauthorized activity. Organizations and individuals are advised to maintain updated blocklists, monitor for similar impersonation domains, and educate users on verifying official domain names and SSL certificates before entering sensitive information. Persistent vigilance is critical, as threat actors often re-deploy similar infrastructure under different domains.