meta-chromextension[.]wixstudio[.]com

This domain is flagged as a high-risk brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet. The site presents itself as an official browser extension for Chrome, Firefox, and Brave, aiming to deceive users into downloading malicious software or disclosing sensitive credentials. Analysis indicates this is a deliberate attempt to exploit trust in the MetaMask brand for fraudulent purposes. Infrastructure analysis reveals multiple indicators of malicious activity. The domain is detected by 15 out of 95 security vendors on VirusTotal, appears on 5 security blocklists, and currently resolves to IP address 34.144.206.118. It was registered through GoDaddy.com, LLC and utilizes a Let's Encrypt SSL certificate for apparent legitimacy. The Gridinsoft trust score for this domain is 0 out of 100, further confirming its fraudulent nature. Technologies detected include Wix, React, Google Cloud, Lodash, HSTS, Google Cloud CDN, and HTTP/3, which are consistent with modern phishing infrastructure. The page title explicitly mimics MetaMask branding, reinforcing the impersonation attempt. Mitigation against this specific threat type requires immediate action from both users and security teams. Users should avoid interacting with the domain, particularly downloading any purported browser extensions. Security teams are advised to block the domain and its resolving IP (34.144.206.118) at the network level, and monitor for any residual connections. Given the domain's presence on multiple blocklists, including those maintained by MetaMask and other security entities, organizations should verify their endpoint protection systems are updated to recognize this threat. Cryptocurrency users should be educated on verifying official download sources and recognizing impersonation tactics in extension marketplaces.