metaamskxtnsion[.]gitbook[.]io

This domain, metaamskxtnsion.gitbook.io, is currently flagged as a high-risk phishing site targeting users of a cryptocurrency wallet service. Analysis indicates the page title explicitly references a sign-in process for an extension labeled 'Metamask,' though the spelling contains non-standard characters ('Metåmåsk'). The domain was registered on March 7, 2026, and remains active as of July 12, 2026. It resolves to the IP address 172.64.147.209, which is part of an infrastructure stack including Cloudflare and Google Cloud services. Infrastructure analysis reveals the use of GitBook for hosting, a platform often employed for documentation but repurposed here for malicious activity. The SSL certificate is issued by Google Trust Services, a legitimate provider, which does not mitigate the domain's malicious intent. Security vendors have detected this domain with varying levels of consensus; 14 out of 95 engines on VirusTotal flag it as malicious, and it appears on three distinct security blocklists. Additional technologies detected include HTTP/3, Google Analytics, and Cloudflare, which may be leveraged to evade detection or track victim interactions. The exact content and functionality of the site have not yet been fully analyzed, but the page title suggests an attempt to harvest credentials by mimicking a legitimate wallet extension login portal. Defenders should treat this domain as an active threat and block it at the network level. Organizations are advised to monitor for connections to 172.64.147.209 and review logs for any user interactions with the domain. Given its presence on multiple blocklists and the high-risk classification, immediate containment actions are recommended. The domain's registration through Cloudflare and its use of widely trusted hosting services underscore the need for layered security controls to detect and mitigate such threats.