extensionmetmask[.]wixstudio[.]com

PhishDestroy identifies extensionmetmask.wixstudio.com as a MetaMask-themed phishing domain distributing malicious browser extensions under Wix Studio hosting. This page impersonates the legitimate MetaMask cryptocurrency wallet to harvest private keys and seed phrases from unsuspecting users. The threat operates as a generic drainer kit, injecting malicious JavaScript payloads to intercept clipboard data and redirect transactions to attacker-controlled addresses. No known affiliation with MetaMask or its parent company ConsenSys was found; the page leverages Wix’s free hosting infrastructure to evade immediate takedowns.

The domain resolves to IPv4 address 34.144.206.118 and operates under a Let’s Encrypt SSL certificate, increasing trust cues for visitors. VirusTotal currently shows 4 out of 95 security engines flagged this domain, leaving it undetected despite active phishing activity. Registration details remain obscured via WHOIS privacy, and the creation date is not publicly disclosed. Google Safe Browsing (GSB) status is unconfirmed, and cross-referencing with public blocklists shows zero inclusion, indicating this is a newly emerged threat with limited historical tracking.

Current status remains active with no known takedown efforts as of this report. Users should avoid visiting or interacting with this domain and report it to their browser vendors or security teams. The risk remains high due to low detection rates and active lure tactics targeting cryptocurrency users. Security researchers are urged to monitor this seed identifier e719c9 for pivoting campaigns using similar infrastructure.