get-metsamzwalt[.]gitbook[.]io

This domain, get-metsamzwalt.gitbook.io, is flagged as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the page hosted a fraudulent guide titled 'MetaMask Wallet | How-to-Use Guide,' designed to deceive users into interacting with malicious content under the guise of legitimate support materials. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with known brand impersonation tactics used to harvest credentials or distribute malware. Infrastructure analysis reveals the domain was registered through GitBook on May 09, 2026, an unusual future date suggesting potential manipulation or misconfiguration. It resolves to IP 104.18.40.47, hosted by Cloudflare in Canada, and presents an SSL certificate issued by Google Trust Services (WE1). The domain is detected by 9 out of 95 security vendors on VirusTotal and appears on three independent blocklists. Automated detection systems, including PhishDestroy, MetaMask’s internal monitoring, and SEAL, have already classified it as malicious. As of the latest verification, the domain has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential reuse of the infrastructure or migration of the campaign to alternative domains. Users who interacted with the site are advised to revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators to prevent future access attempts.