metamask-eng[.]wixstudio[.]com

PhishDestroy identifies an active brand impersonation campaign targeting MetaMask users. The domain metamask-eng.wixstudio.com falsely mimics MetaMask’s official branding, currently classified as under investigation. This threat involves a phishing attempt to deceive victims into entering sensitive wallet credentials under the guise of MetaMask support or promotional services.

This domain, resolved to IP 34.144.206.118 via Let's Encrypt SSL, was flagged by 0 of 95 VirusTotal vendors, indicating it is not yet widely recognized by antivirus engines. Registrar details remain unverified pending deeper analysis, but the WixStudio hosting platform suggests a subdomain abuse tactic. The domain is newly associated with malicious impersonation, warranting heightened scrutiny. No listings on major blocklists such as Google Safe Browsing, PhishTank, or OpenPhish exist yet, though automatic detection remains lagging.

PhishDestroy assesses this threat as active and escalating. The absence of vendor detections suggests the campaign is either very recent or deliberately evading static analysis using legitimate infrastructure. Users interacting with this domain risk credential theft, wallet compromise, or malware download. Immediate actions include blocking the IP 34.144.206.118 at the network perimeter, reporting the domain via MetaMask’s official phishing portal, and advising all crypto users to verify URLs via the official MetaMask website—not via search links or unsolicited messages. Exercise extreme caution with any Wix-hosted subdomain claiming MetaMask affiliation.