metamasextension[.]wixstudio[.]com

PhishDestroy identifies metamasextension.wixstudio.com as an active Chrome extension phishing page specifically targeting MetaMask users, currently under investigation with zero VirusTotal detections as of seed 6ee437.

This domain resolves to IP 34.144.206.118 and operates under a Let’s Encrypt SSL certificate. The Wix-hosted subdomain is hosted on Google Cloud infrastructure. As of the latest scan, VirusTotal shows 5/95 security vendors flagging the domain. Creation date and blocklist status remain unverified, and publicly available trust scores indicate no prior reputation history. The lack of detections suggests this phishing campaign is either newly deployed or deliberately evading detection using trusted cloud hosting and subdomain services.

Risk mitigation starts with immediately blocking access to both the domain and IP 34.144.206.118 at the network firewall. Users who may have entered credentials or downloaded the fake extension should revoke MetaMask permissions via the official wallet interface, reset browser settings, and run a full antivirus scan. Chrome users should also disable or remove any unknown extensions named “MetaMask” or similar. Report the domain to MetaMask’s phishing reporting channel and submit it to PhishDestroy for further analysis and rapid takedown coordination.