metamsksnr[.]gitbook[.]io

This domain, metamsksnr.gitbook.io, is identified as a high-risk phishing site impersonating MetaMask, a widely used cryptocurrency wallet. The page title, 'MetaMask Chrome Extension: Elevate your crypto experience | us,' explicitly mimics official MetaMask branding to deceive users into entering sensitive credentials, such as wallet recovery phrases or private keys. Such impersonation attacks are commonly used to facilitate unauthorized access to cryptocurrency assets, leading to financial theft and account compromise. Analysis indicates the domain was registered on March 30, 2014, and is hosted through Cloudflare, Inc. (AS13335), resolving to the IP address 104.18.40.47. Despite its long registration history, the domain is flagged by 18 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent, as phishing sites frequently employ valid certificates to appear legitimate. Google Safe Browsing has also classified this domain as phishing, reinforcing its fraudulent nature. Users who visited metamsksnr.gitbook.io should immediately revoke any permissions granted to browser extensions or applications linked to the domain. If credentials or recovery phrases were entered, affected users must transfer assets to a new, secure wallet and monitor accounts for unauthorized transactions. Browser caches and stored credentials should be cleared to prevent persistent access by malicious actors. Additionally, network-level blocking of the domain and its associated IP (104.18.40.47) is recommended to prevent further exposure.