help-mtscmskkextnsn[.]gitbook[.]io

The domain help-mtscmskkextnsn.gitbook.io poses a brand impersonation threat, targeting users of the MetaMask Chrome extension. This domain is designed to trick users into believing they are accessing legitimate MetaMask resources, potentially leading to the disclosure of sensitive information such as private keys, wallet addresses, and login credentials.

Analysis indicates that the domain was registered through Cloudflare, Inc., and created on March 30, 2014. It resolves to the IP address 104.18.40.47, which is located in the United States under the AS13335 Cloudflare, Inc. network. The SSL certificate is issued by Google Trust Services / WE1, adding a layer of perceived legitimacy. According to VirusTotal, 17 out of 95 security vendors have flagged this domain as malicious, and it appears on 1 security blocklist. The domain was successfully taken offline, but the potential risk remains for those who may have visited it before it was blocked.

If users have visited help-mtscmskkextnsn.gitbook.io, they should immediately check their MetaMask accounts for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication (2FA) if not already in place. Users should also monitor their transaction history and consider reporting any suspicious activity to MetaMask support. Regular security updates and cautious verification of domain URLs can help prevent future incidents of brand impersonation.