metamskdwnld[.]gitbook[.]io

This domain is flagged as a high-risk crypto drainer infrastructure impersonating MetaMask, a widely used cryptocurrency wallet. The site is designed to trick users into entering sensitive credentials or connecting wallets, enabling unauthorized fund transfers from victim accounts. Analysis indicates this is not a generic phishing attempt but a targeted attack on cryptocurrency holders, leveraging brand trust to execute financial theft. Infrastructure analysis reveals the domain metamskdwnld.gitbook.io was created on March 30, 2014, and remains active under Cloudflare, Inc registration. It resolves to IP address 104.18.40.47 and is currently flagged by 6 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. Despite its long-standing registration, the domain exhibits no legitimate association with MetaMask or its parent company, and no known blocklists have fully mitigated its reach at this time. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP at network and endpoint levels. Users should be educated to verify wallet connection prompts by cross-referencing official MetaMask domains and avoiding interaction with third-party documentation platforms claiming to offer wallet services. Cryptocurrency holders are advised to revoke any unauthorized wallet connections and monitor transaction histories for anomalies. Organizations should implement strict allowlisting for wallet-related domains and enforce multi-factor authentication for all crypto asset access points.