metamsk-log-wallet-view-io[.]my[.]canva[.]site

This domain, metamsk-log-wallet-view-io.my.canva.site, is flagged as a confirmed phishing portal specifically targeting MetaMask users through brand impersonation. Analysis indicates the site presents a fraudulent login interface mimicking the official MetaMask wallet service, designed to harvest cryptocurrency wallet credentials and seed phrases. The page title, 'MetaMask® Login | Wallet, PortFolio Sign Up - Official Account Help,' reinforces the deception by claiming affiliation with the legitimate MetaMask platform. No explicit crypto drainer kit signatures were detected in initial scans, though credential harvesting remains the primary attack vector. Infrastructure analysis reveals multiple critical technical indicators. The domain holds a VirusTotal detection score of 9/95, with security vendors flagging it for malicious activity. It was registered through Gandi SAS on April 03, 2018, though the subdomain appears to have been weaponized recently. The domain resolves to IP address 103.169.142.6, geolocated to Australia under AS209242 (Cloudflare London, LLC). The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security. The domain appears on one security blocklist and was previously blocked by PhishDestroy. No Google Safe Browsing (GSB) flags were reported at the time of assessment. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. The registrar, Gandi SAS, has not yet taken enforcement action beyond standard abuse reporting procedures. Users who accessed the site prior to takedown should assume credential compromise and immediately rotate MetaMask seed phrases, revoke connected dApp sessions, and monitor wallet activity for unauthorized transactions. Organizations should update blocklists to include this domain and associated IP to prevent potential re-emergence.