ioometamskxtension[.]gitbook[.]io

This domain ioometamskxtension.gitbook.io resolves to IP 172.64.147.209 and uses nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. It is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services under WE1. The domain was created on March 30, 2014, and currently returns HTTP status 307 while serving content under the page title MetaMask® Extension – Browser Extension | us. Infrastructure analysis reveals Cloudflare and HTTP/3 technologies in use at an IP located in the US under AS13335 Cloudflare, Inc. The brand target is listed as MetaMask with impersonation noted and the scam type recorded as seed_phish.

Detection data shows the domain appears on 1 security blocklist and is blocked by PhishDestroy. VirusTotal reports 14 out of 95 security vendors flagging the domain. The status remains active as of the report date July 12, 2026. These indicators establish a direct link to brand impersonation targeting MetaMask with seed phishing classification based on the provided threat type.

Exact page content remains unanalyzed beyond the recorded title and title fragment. No additional kit identifiers or further infrastructure mappings are supplied in the available data. Defenders should block the domain and IP 172.64.147.209 at network perimeters, monitor for DNS queries to the listed nameservers, and correlate any observed traffic with the known VirusTotal detection ratio. Continued observation of the active status and single blocklist presence supports ongoing enforcement actions without reliance on unconfirmed elements.