mtmskchrpmxtnsion[.]gitbook[.]io

The domain mtmskchrpmxtnsion.gitbook.io is confirmed to be engaged in brand impersonation targeting MetaMask, a widely used Ethereum wallet service. Analysis indicates this infrastructure is designed to deceive users into interacting with fraudulent content under the guise of an official MetaMask Chrome extension. The site remains active as of the latest verification, posing a high risk to cryptocurrency users. Infrastructure analysis reveals the domain was registered on March 30, 2014, though its current malicious use appears to be a recent development. It is hosted through Cloudflare, Inc., and resolves to the IP address 104.18.40.47. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. The page title, 'Metamask® Chrome | Extension® | Bridge to Ethereum-Based,' mimics official MetaMask branding. Security vendors on VirusTotal have flagged this domain, with 6 out of 95 engines detecting it as malicious. No additional blocklist entries or trust scores were identified beyond this data. Current status confirms the domain remains active and operational. Users are advised to avoid interaction with this infrastructure, particularly those seeking MetaMask-related downloads or services. Organizations should update web filtering rules to block access to mtmskchrpmxtnsion.gitbook.io and monitor for similar impersonation attempts targeting cryptocurrency platforms. Verification of all browser extensions and software should be performed exclusively through official vendor channels to mitigate exposure to such threats.