nav-metamsk-io[.]wixstudio[.]com

This domain, nav-metamsk-io.wixstudio.com, is identified as a high-risk crypto wallet drainer phishing site specifically targeting users of the MetaMask cryptocurrency wallet service. The domain is currently offline, though prior activity indicates it was designed to harvest credentials and execute unauthorized transactions by mimicking legitimate MetaMask interfaces. Analysis confirms this infrastructure was actively used to deceive victims into disclosing sensitive wallet information, leading to direct financial losses. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on December 17, 2016, though recent malicious activity suggests compromise or repurposing of existing infrastructure. It resolves to the IP address 34.144.206.118 and is associated with a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. The domain is flagged by 13 of 95 security vendors on VirusTotal, and appears on five distinct security blocklists, including those maintained by MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. Additionally, Gridinsoft assigns a trust score of 0 out of 100, further corroborating its malicious classification. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the risk of re-emergence or migration to similar domains remains high. Organizations and individuals are advised to block the domain and its associated IP address at the network level, update endpoint protection signatures, and conduct retrospective log analysis to identify any prior interactions. Users who may have engaged with this domain should immediately revoke any active wallet sessions, transfer assets to a new secure wallet, and monitor transaction histories for unauthorized activity. Proactive monitoring for domain squatting variants (e.g., typosquatting or homoglyphs) is recommended to mitigate future exposure.