metamaskiologil-1[.]gitbook[.]io

The domain metamaskiologil-1.gitbook.io is identified as a brand impersonation threat targeting MetaMask, and it is currently offline. This domain poses an elevated risk level, indicating a significant potential for harm to users who may be misled into believing it is a legitimate MetaMask resource.

Infrastructure analysis reveals that the domain was registered through Cloudflare, Inc and created on March 30, 2014. It resolves to the IP address 172.64.147.209 and uses an SSL certificate issued by Google Trust Services. The domain has been flagged by 14 out of 95 security vendors on VirusTotal, and it appears on 2 security blocklists, specifically PhishDestroy and OISD. These indicators suggest that the domain has been actively used in phishing campaigns to deceive users into providing sensitive information.

Given that the domain is currently offline, the immediate risk to users is mitigated. However, it is recommended that organizations and individuals continue to monitor for any resurgence of activity. Security teams should consider adding this domain to their blocklists to prevent any potential future attacks. Additionally, users should be educated on the importance of verifying the authenticity of URLs and using official MetaMask resources to avoid falling victim to similar impersonation threats.