metamuskio-extn[.]wixstudio[.]com

PhishDestroy identifies metamuskio-extn.wixstudio.com as a live fake Metamask wallet extension phishing site under active investigation. The domain masquerades as a legitimate browser extension to steal user credentials and cryptocurrency, with no known drainer kit linked at this stage. The threat actor leverages Wix’s hosting infrastructure to lend superficial credibility while deploying a spoofed interface resembling the official Metamask extension.

Technical indicators confirm this is a low-detection but high-risk domain. VirusTotal scores it 4/95 detections as of latest scan, with a valid Let’s Encrypt SSL certificate issued on 2023-11-05. The domain resolves to IP 34.144.206.118 via a Google Cloud Platform host. Registrar information points to MarkMonitor, and Google Safe Browsing (GSB) currently does not flag the domain. WHOIS data shows creation on 2023-10-20, placing its age at approximately six weeks. While not yet widely blocked, it remains unlisted across major threat intelligence feeds.

The domain is still active as of the latest observation. No takedown action has been recorded, and the site continues to serve the fake extension page. Remaining risk is classified as high due to the combination of Metamask branding, active hosting, and zero detections—indicating it is likely a newly deployed attack vector. Users are advised to avoid clicking any links to this domain and to verify extension sources via official Metamask channels only.