metawallet[.]wixstudio[.]com

This domain, metawallet.wixstudio.com, is identified as a crypto drainer infrastructure designed to siphon cryptocurrency assets from victim wallets. Analysis indicates the site employs malicious JavaScript and smart contract interactions to initiate unauthorized transactions, a hallmark of crypto drainer kits such as Angel Drainer or Inferno Drainer. The domain mimics legitimate wallet services, likely to deceive users into connecting their wallets, thereby exposing private keys or signing malicious payloads. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 34.144.206.118 and is registered through GoDaddy.com, LLC, with a creation date of December 17, 2016. Security vendors on VirusTotal flag the domain at a rate of 8/95, indicating elevated detection. The domain appears on three security blocklists, and its Gridinsoft trust score is 0/100. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. Google Safe Browsing (GSB) does not currently list the domain, though it is blocked by multiple wallet security extensions. The domain is currently offline, reducing immediate risk to users. However, historical data and forensic evidence suggest the infrastructure may be reactivated or repurposed under a different domain. Response actions by security providers, including MetaMask and PhishDestroy, have mitigated exposure, but residual risk remains due to the domain’s prior use in crypto theft. Users are advised to verify wallet connections, revoke unauthorized smart contract approvals, and monitor transaction histories for irregular activity. Persistent vigilance is recommended, as crypto drainer campaigns often reuse infrastructure or shift to new domains.