metamask--wallet--xtension[.]gitbook[.]io

Analysis of the domain metamask--wallet--xtension.gitbook.io shows a high‑risk brand‑impersonation campaign targeting MetaMask users. The site was created on March 30, 2014 and is registered through Cloudflare, Inc., using the authoritative name servers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. DNS resolution points to IP address 172.64.147.209, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate‑looking HTTPS connection that may reduce user suspicion.

HTTP responses return a 307 temporary redirect, and the server advertises Cloudflare and HTTP/3 as underlying technologies. The page title, "MetaMask® Wallet Extension | Bridge to Ethereum-Based^ | us," directly references the MetaMask brand, confirming the impersonation intent. VirusTotal scans have flagged the domain by 14 of 95 security vendors, and the domain appears on one external security blocklist. Independent blocking by PhishDestroy is recorded, yet the domain remains active as of the report date, July 23, 2026.

Additional reputation metrics are poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain is categorized as a crypto‑scam. The observable evidence—registered infrastructure, IP address, SSL issuer, HTTP status, detection counts, and blocklist presence—provides sufficient indicators for defensive controls. Defenders should add the IP 172.64.147.209 and the fully qualified domain name to network‑level deny lists, enforce URL filtering against the domain, and monitor for any authentication attempts to MetaMask services originating from this host. Continuous re‑evaluation is advised because the underlying Cloudflare infrastructure can be repurposed, potentially shifting the hosting IP while retaining the same domain registration details.