startedmetamaskapp[.]wixstudio[.]com

This domain is flagged as a high-risk brand impersonation threat targeting cryptocurrency wallet users. Analysis indicates the infrastructure was specifically designed to mimic MetaMask, a widely used digital asset management platform, with the intent to harvest credentials or deploy crypto-draining malware. The threat type is classified as brand_impersonation, a technique commonly used to exploit user trust in established brands for financial fraud or unauthorized access to sensitive accounts. Infrastructure analysis reveals the domain startedmetamaskapp.wixstudio.com was registered through GoDaddy.com, LLC on April 15, 2026, an anomalous future date suggesting potential domain spoofing or registrar manipulation. The domain resolves to the IP address 34.144.206.118 and employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by at least two specialized threat intelligence feeds. Technologies detected include Wix hosting, React framework, and Google Cloud infrastructure, which are legitimate services but frequently abused for phishing operations due to their accessibility and perceived trustworthiness. To mitigate risks associated with this brand impersonation threat, users are advised to verify domain authenticity before interacting with any cryptocurrency-related platform. Specifically, check for official domain registrations, avoid clicking on links from unsolicited communications, and use browser-based security extensions that flag known malicious domains. Organizations should implement domain monitoring to detect newly registered domains containing brand names and enforce strict access controls for cryptocurrency wallets. Endpoints should be configured to block connections to known malicious IPs, such as 34.144.206.118, and security teams should prioritize updating blocklists with confirmed indicators of compromise from this campaign.