meta-mask-login[.]my[.]canva[.]site

The domain meta-mask-login.my.canva.site was created on 03 April 2018 and is registered through GANDI SAS. It resolves to the IP address 103.169.142.250, which is assigned to Cloudflare London, LLC (AS209242) and geolocated to Australia. The hosting provider is identified as Cloudflare and the site served HTTP/3 over a TLS certificate issued by Google Trust Services under the WE1 trust anchor. An HTTP request returned a 404 status code, indicating the page is no longer accessible.

The page title observed during the brief analysis was “Metamask Login”, and the brand target is explicitly listed as MetaMask, classifying the activity as a crypto‑related brand impersonation. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy has added it to its blocklist; the domain also appears on a single external security blocklist. VirusTotal analysis shows that nine of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment. Nameservers jean.ns.cloudflare.com and junade.ns.cloudflare.com are in use, consistent with the Cloudflare infrastructure.

The current status is offline, and the site has been taken down. While the domain’s content cannot be inspected directly, the combination of brand impersonation, malicious detections, and the presence of a TLS certificate issued to a legitimate authority suggests a deliberate attempt to lure MetaMask users. Defenders should continue to block the domain at network and endpoint layers, monitor for any resurgence of the same host or similar subdomains, and educate users that legitimate MetaMask interactions never occur on third‑party domains. Ongoing surveillance of the associated IP and registrar may reveal future campaigns employing the same infrastructure.