metimskwlttxtensn[.]gitbook[.]io

This domain, metimskwlttxtensn.gitbook.io, is flagged as a high-risk brand impersonation threat specifically targeting MetaMask, a widely used cryptocurrency wallet. Analysis indicates the site was designed to deceive users into believing it is an official MetaMask extension for Firefox, as evidenced by the page title MetaMask™ Wallet Extension | Get this Extension for Firefox (en-US). The intent is likely credential harvesting or cryptocurrency theft through fraudulent wallet interactions, a common tactic in cryptocurrency phishing schemes. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain is detected by 18 out of 95 security vendors on VirusTotal, signaling broad recognition as a threat. It resolves to the IP address 172.64.147.209, registered under Cloudflare, Inc. (AS13335), a provider frequently leveraged to obscure malicious infrastructure. The domain was created on March 30, 2014, though this date may reflect domain squatting or reuse rather than the inception of malicious activity. It appears on three security blocklists, including PhishDestroy and SEAL, and is blocked by MetaMask’s own protections. The SSL certificate is issued by WE1, a common certificate authority that does not inherently indicate legitimacy. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to end users. However, the infrastructure remains a latent risk, as domains hosted on Cloudflare can be rapidly reactivated or repurposed. The high detection rate, combined with the targeted impersonation of a cryptocurrency wallet, underscores the need for continued monitoring. Users are advised to verify the authenticity of any wallet extension by cross-referencing official sources and to treat domains mimicking trusted brands with extreme caution, particularly those hosted on content delivery networks or free hosting platforms.