metamak-extension[.]wixstudio[.]com

This domain, metamak-extension.wixstudio.com, is identified as a high-risk crypto drainer phishing site targeting cryptocurrency wallet users. Analysis indicates the domain was designed to impersonate legitimate browser extension services, likely deploying malicious scripts to drain funds from connected wallets. No direct brand impersonation is evident, but the infrastructure aligns with known drainer kits used in recent campaigns, particularly those leveraging cloud-based hosting and content delivery networks to evade detection. Infrastructure analysis reveals multiple concrete technical indicators. The domain was registered on April 27, 2026, through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Security vendors on VirusTotal flagged the domain with a detection score of 14/95, while it appears on five distinct security blocklists, including MetaMask and PhishingArmy. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Technologies detected include Wix, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3, which may have been used to enhance performance and obfuscate malicious traffic. As of the latest assessment, the domain is offline, returning a 404 error page titled '404 Error: Page Not Found | Wix Studio.' While the immediate threat has been mitigated, the domain’s registration details, hosting provider, and prior detection history suggest a deliberate phishing operation. Users who interacted with this domain should assume potential exposure and take immediate action, including revoking wallet permissions, scanning for unauthorized transactions, and monitoring connected accounts for suspicious activity. The residual risk remains high due to the domain’s prior use and the likelihood of similar infrastructure being redeployed under new domains.