hub-app-metamao[.]gitbook[.]io

The domain hub-app-metamao.gitbook.io is classified as a high‑risk brand‑impersonation site targeting MetaMask. The page title retrieved from the host reads “MetaMask® Wallet Extension | | Bridge to Ethereum‑Based | 𝙼𝚎𝚝𝚊𝙼𝚊𝚜𝚔©”, confirming the intent to mimic the MetaMask brand. The site was registered on June 13, 2026 and is hosted on GitBook infrastructure backed by Google Cloud services, with HSTS, Google Cloud Trace, and HTTP/3 enabled. DNS is served by Cloudflare (nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com); the domain resolves to IP 172.64.147.209, an address owned by Cloudflare, Inc. SSL is provisioned by Google Trust Services (WE1) and the site returns an HTTP 307 redirect. VirusTotal reports 14 of 91 security vendors flagging the domain, and it appears on three external blocklists. It is already blocked by PhishDestroy, MetaMask, and SEAL, but remains active. No additional content analysis is available beyond the page title, so the exact malicious payload or credential‑capture mechanisms are unconfirmed. Defenders should add hub-app-metamao.gitbook.io to network deny‑lists, enforce DNS filtering, and update intrusion‑detection signatures to detect HTTP 307 redirects from this host. Monitoring of Cloudflare‑associated IP ranges for similar brand‑impersonation activity is also advised, as is user awareness messaging regarding unsolicited MetaMask‑related links.