metmskuxtension[.]gitbook[.]io

This domain, metmskuxtension.gitbook.io, is an active brand impersonation threat specifically targeting MetaMask users through a crypto drainer scheme. The page title 'Metamask Extension | Bridge to Ethereum-Based' mimics legitimate MetaMask branding to deceive visitors into connecting their wallets, leading to asset theft. The domain remains operational and poses a high risk to cryptocurrency users.

Infrastructure analysis reveals the domain is flagged by 15 of 95 VirusTotal security vendors, indicating widespread detection. It is registered through Cloudflare, Inc. and was created on March 30, 2014, which may lend false legitimacy. The domain resolves to IP address 104.18.40.47 and uses an SSL certificate from Google Trust Services. Hosted on GitBook with Google Cloud infrastructure, the site employs Cloudflare, HTTP/3, HSTS, and Google Cloud Trace technologies. No blocklist count or trust scores were provided in the intelligence, but the vendor detection ratio confirms malicious activity.

Current status is active with no reported takedown. Users should avoid visiting or interacting with this domain entirely. Recommendations include blocking the domain at network and browser levels, reporting to hosting providers (GitBook, Google Cloud, Cloudflare), and warning users against connecting wallets or entering credentials on any site associated with this domain. Immediate action is advised to prevent financial losses from crypto drainer attacks.