m3tamsklogn[.]gitbook[.]io

The domain m3tamsklogn.gitbook.io has been identified as a brand impersonation phishing threat specifically targeting MetaMask, the popular cryptocurrency wallet. This domain is currently offline, having been taken down after its malicious activity was confirmed. The page title, "M𝐞tåMäsk® Login$", is a deceptive attempt to lure users into entering their credentials or private keys, effectively acting as a crypto drainer.

Technical analysis reveals that this domain was flagged by 14 out of 95 security vendors on VirusTotal, indicating a consensus among security tools about its malicious nature. It was created on May 09, 2026, and registered through Cloudflare, Inc. The domain resolves to IP address 104.18.40.47 and appears on three security blocklists. The SSL certificate is issued by Google Trust Services under the identifier WE1, which may give a false sense of legitimacy to unsuspecting visitors.

Given that the domain is now offline, users are currently protected from this specific threat. However, PhishDestroy strongly advises all MetaMask users to remain vigilant and always verify the authenticity of any site claiming to be a MetaMask login page. Never enter your seed phrase or private keys on any website, and only use the official MetaMask extension or mobile app. If you have already interacted with this domain, immediately transfer your assets to a new wallet and revoke any token approvals. PhishDestroy continues to monitor for similar threats and provides real-time verification tools to help users avoid phishing traps.