meta-metamask[.]my[.]canva[.]site

On July 24, 2026, analysis of the domain meta-metamask.my.canva.site shows a high‑risk brand‑impersonation campaign targeting MetaMask users. The site was registered through Gandi SAS on 3 April 2018 and resolves to IP 103.169.142.250, which belongs to ASN AS209242 operated by Cloudflare London, LLC. Both authoritative nameservers, jean.ns.cloudflare.com and junade.ns.cloudflare.com, belong to Cloudflare, and the connection is protected by an SSL certificate issued by Google Trust Services (WE1). The HTTP response returned a 404 status, indicating that the original page is no longer accessible; however, historical data capture the page title “MetaMask®Extension® | Getting started with MetaMask™”, which aligns with the declared impersonation of the MetaMask brand.

The infrastructure is further corroborated by detection by Google Safe Browsing, which flagged the domain for social engineering, and by a VirusTotal scan that recorded 14 of 95 security vendors marking the domain as malicious. PhishDestroy has actively blocked the domain, and it appears on at least one public security blocklist. The site employed Cloudflare’s HTTP/3 protocol, suggesting a modern delivery stack often leveraged by threat actors to hide behind reputable services.

While the domain is currently offline, the combination of brand‑specific page title, registrar information, hosting context, and multiple vendor detections constitute strong evidence of a crypto‑related scam infrastructure. Defenders should add meta-metamask.my.canva.site to internal blacklist feeds, monitor its DNS records for any re‑activation, and incorporate the observed sub‑domain pattern into URL filtering rules. Continued vigilance is advised, as the underlying hosting provider could be used to spin up new impersonation sites that reuse the same brand terminology.