metamskdwnld.gitbook.io
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of metamskdwnld.gitbook.io
This domain appears to be a GitBook-hosted page presenting itself as documentation or installation guidance for the MetaMask browser extension. The page title, metadata, and screenshot all reference “MetaMask Chrome Extension” and “How to install,” and the content appears to imitate official product-help or onboarding material for a cryptocurrency wallet and Web3 browser extension.
Based on the subdomain structure, the page is hosted under gitbook.io rather than on MetaMask’s primary brand domain. GitBook is a legitimate documentation publishing platform, but pages hosted on shared publishing platforms can be created by third parties. In this case, the naming pattern “metamskdwnld” and the use of MetaMask branding suggest the page may be attempting to resemble official MetaMask documentation or download instructions.
The site does not appear to be a full e-commerce store. Instead, it appears to function as a branded landing page or documentation-style resource related to cryptocurrency software installation, which places it closer to a crypto-wallet support/download page than a conventional business website.
Safety Assessment for metamskdwnld.gitbook.io
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 14 out of 91 security engines, with the detections broadly describing phishing or malicious behavior. In addition, the page visually presents MetaMask branding while being hosted on a third-party GitBook subdomain rather than an official MetaMask-owned domain, which closely resembles brand impersonation and may be intended to mislead visitors seeking the real wallet extension.
Other signals are mixed but do not outweigh the phishing indicators. A malware file scan did not identify flagged files at the time of analysis, and several major threat databases were clean. However, the domain’s IP address is listed on one mail-reputation blocklist, which is a weaker signal on its own but still worth noting. The absence of direct malware findings does not negate the stronger phishing-related detections and the misleading branding pattern visible on the page.
Given the multi-engine phishing consensus, the use of a look-alike MetaMask-themed GitBook page, and the very low published trust score, this website may pose potential risks to visitors at the time of this scan.
Technical Description
The site is delivered over HTTPS with a valid TLS certificate issued by Google Trust Services, and it is served through Cloudflare infrastructure on IP address 172.64.147.209. The hosting location resolves to Canada, and the web server is fronted by Cloudflare. The domain uses Cloudflare nameservers, while DNSSEC appears to be unsigned.
From a technical standpoint, the page is lightweight and GitBook-hosted, with supporting assets loaded from GitBook and related content-delivery domains. No malicious files were flagged in the available file scan, but the main concern here appears to be social-engineering or phishing risk rather than exploit delivery. The use of a trusted hosting/CDN setup and valid SSL should not be interpreted as proof of legitimacy, as such services are commonly used by both legitimate and deceptive pages.
Share your experience with this website. Was it safe? Did you encounter any issues?