metamaskchomeextension[.]ukit[.]me

The domain metamaskchomeextension.ukit.me is flagged as a high‑risk brand‑impersonation site targeting MetaMask users. Infrastructure analysis shows the host resolves to IP 185.129.100.126, which is owned by AS57724 DDoS‑Guard Ltd and geolocated in Russia. The server runs a Node.js stack with Express, Bootstrap, and RequireJS, and includes analytics services Yandex.Metrika and Google Analytics, as well as DDoS‑Guard protection. The SSL certificate is issued by GoGetSSL RSA DV CA. Registration details indicate the domain was created on 21 February 2026 through RU‑CENTER, and the authoritative nameservers are ns1‑ns3.ukit.com. The site appears on two reputable blocklists (PhishDestroy, Enkrypt) and received a Gridinsoft trust score of 0 / 100. VirusTotal reports three detections out of 93 scanners, reinforcing the malicious classification. The observed page title, "uKit — Website's trial period has expired," does not match the advertised MetaMask brand, suggesting the page may be a placeholder or a lure used to redirect victims. Concrete evidence includes the blocklist listings, the Russian IP with DDoS‑Guard association, and the low trust score. However, the exact content served to users beyond the title has not been captured, leaving the precise phishing or credential‑harvesting mechanism uncertain. Defenders should block the domain at network perimeters, add the IP to threat‑intel feeds, and monitor for any DNS resolutions to the listed nameservers. End‑users should be warned not to enter MetaMask credentials on any site presenting this domain, and organizations should update web‑filter policies to include this indicator of compromise.