metamaskbroavwser[.]gitbook[.]io

The domain metamaskbroavwser.gitbook.io is flagged as an active brand‑impersonation infrastructure targeting MetaMask. Registration occurred on 23 April 2026 via Cloudflare, Inc., and the domain resolves to IP 104.18.40.47, a Cloudflare address located in CA. DNS is served by dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The site is hosted on the GitBook platform, utilizes Google Cloud services, and presents a TLS certificate issued by Google Trust Services (WE1). HTTP responses return a 307 redirect and the service advertises HSTS, HTTP/3, and Cloudflare tracing features. The page title captured is “Metamask® Chrome® Extension® - Getting started with MetaMask | us,” indicating an attempt to mimic official MetaMask documentation. Security telemetry shows a Gridinsoft trust score of 0 / 100 and 18 of 94 VirusTotal scanners flag the domain as malicious. It is listed on three external blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. While the exact page content has not been examined, the combination of brand‑specific title, high‑risk classification, and multiple detections supports a high‑confidence judgment of malicious intent. Defenders should block the domain at network perimeter, add it to threat‑intel feeds, and monitor for related C&C patterns. Further investigation of the redirected endpoint is recommended to confirm any credential‑harvesting functionality.