metamaskextensuon[.]blogspot[.]com

This domain, metamaskextensuon.blogspot.com, is an active brand impersonation site targeting MetaMask users. Registered on March 12, 2026, through Google Blogger, it employs a deceptive page title that reads Metamask Extension - metamask wallets meta. The domain uses several technologies, including Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3, indicating a modern web stack designed to mimic legitimate services. The SSL certificate is issued by Google Trust Services, which is typical for Blogger-hosted sites, but the content itself is fraudulent. The domain resolves to IP address 142.251.127.132, which is consistent with Google infrastructure, as Blogger domains commonly resolve to Google-owned IP ranges. The Gridinsoft trust score is 0 out of 100, confirming the site is untrustworthy. VirusTotal flags this domain with 14 out of 95 security vendors marking it as malicious, and it appears on three security blocklists. Security vendors SEAL, MetaMask, and PhishDestroy have already blocked this domain. The site is still active as of July 12, 2026, meaning it continues to pose a risk to users who may encounter it through search results, social media, or phishing emails. The domain name itself contains a misspelling of MetaMask, using extensuon instead of extension, which is a common typosquatting tactic. The page likely prompts visitors to enter their MetaMask wallet credentials or seed phrases, leading to theft of cryptocurrency assets. While the hosting infrastructure is legitimate Google Blogger, the malicious intent is clear from the impersonation and the low trust score. Defenders should ensure this domain is added to blocklists and monitor for similar variations. Users should avoid visiting the site and report it to Google for abuse. Organizations protecting crypto users should update their security filters to include this domain and train users to verify official MetaMask channels before entering sensitive information.