mmetiskextionlugin[.]gitbook[.]io

Analysis of the domain mmetiskextionlugin.gitbook.io indicates an active brand‑impersonation operation targeting Metamask users. The site was registered on 21 February 2026 through Cloudflare, Inc. and is hosted on the Cloudflare network (ASN 13335) with the IP address 104.18.40.47 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, confirming the provider’s involvement. The web server returns an HTTP 307 status and serves content over HTTP/3, employing a TLS certificate issued by Google Trust Services under the WE1 root, which further obscures the underlying infrastructure.

The page title observed is “Metamask® Extension® | us”, directly referencing the Metamask brand and matching the reported impersonation vector. Google Safe Browsing classifies the URL as social‑engineering, and VirusTotal records 16 detections out of 93 scanning engines, reinforcing the malicious assessment. Additional intelligence shows a Gridinsoft trust score of 0 / 100 and inclusion on a single security blocklist, while the PhishDestroy service has already blocked the domain. The combination of brand‑specific page title, Cloudflare‑based hosting, and multiple vendor detections demonstrates a high‑risk crypto‑scam profile.

Uncertainty remains regarding the exact payload delivered to victims, as no page content beyond the title has been disclosed. Defensive teams should block the domain at DNS and proxy layers, monitor for outbound connections to the associated IP, and update web filtering rules to include the observed page title and SSL fingerprint. Continuous monitoring of Cloudflare‑hosted domains that reference Metamask is advised, given the rapid creation of similar impersonation sites.