help-metaxsioe[.]gitbook[.]io

The domain help-metaxsioe.gitbook.io is a high-risk brand impersonation threat specifically targeting MetaMask users. As of the latest analysis, the site is offline, but while active it hosted a page titled "MetaMask® Chorme Extensioᵰ* - Browser Extensioᵰ* | us," designed to trick visitors into believing they were accessing legitimate MetaMask browser extensions. This domain was created on May 18, 2026, and registered through Cloudflare, Inc, with an SSL certificate issued by Google Trust Services / WE1. It resolved to IP address 104.18.40.47.

Security intelligence reveals that the domain was flagged by 16 out of 95 VirusTotal vendors, indicating widespread detection across the security community. It also appeared on 3 security blocklists, underscoring its malicious nature. Despite these red flags, the domain’s registration through Cloudflare and use of a valid SSL certificate may have lent it an air of legitimacy to unsuspecting users. PhishDestroy’s analysis confirms the site was a sophisticated phishing attempt, leveraging MetaMask’s brand to harvest credentials or install malware.

Currently, the domain has been taken offline, neutralizing the immediate threat. However, users who may have interacted with the site should take precautionary measures: change any passwords entered, enable two-factor authentication on their MetaMask wallets, and monitor accounts for unauthorized activity. PhishDestroy recommends always verifying URLs directly through official channels and avoiding clicking links in unsolicited messages. For a detailed breakdown of this threat and others, check the full report.