metamasklogin-x[.]gitbook[.]io

Analysis conducted on July 23, 2026 identifies metamasklogin-x.gitbook.io as a high‑risk brand‑impersonation site targeting MetaMask users. The domain, created on March 30, 2014 and registered through Cloudflare, Inc., resolves to IP address 104.18.40.47, an address owned by Cloudflare (AS13335) located in the United States. SSL termination is provided by a Google Trust Services certificate, and the site serves content over HTTPS with HSTS enabled, indicating a legitimate TLS configuration despite the malicious intent. Infrastructure observation reveals the use of GitBook, Google Cloud services, Google Cloud Trace, and Cloudflare’s HTTP/3 delivery. The page title returned by the server – “Metamask Login - Browser Extension | Digital Crypto Wallet” – directly references the MetaMask brand, confirming the impersonation claim.

An HTTP 403 response is currently observed, and the domain status is listed as offline, yet the site remains indexed by multiple blocklists. PhishDestroy, MetaMask’s own blocklist, and SEAL have all listed the domain, and it appears on three additional security blocklists. VirusTotal analysis shows that 13 of 94 scanned security vendors flag the domain as malicious, reinforcing the classification as a crypto‑related scam. The Gridinsoft trust score of 0 out of 100 further underscores the lack of credibility.

No evidence of alternative hosting, content delivery networks beyond Cloudflare, or additional sub‑domains is present in the available data. Defenders should immediately block traffic to metamasklogin-x.gitbook.io at network perimeter and DNS layers, and add the domain to endpoint allow‑list exclusions for phishing detection. Continuous monitoring of the IP address 104.18.40.47 for any resurgence of malicious activity is advised. Because the site’s content has not been publicly captured, further forensic collection of page snapshots would improve attribution, but existing indicators already warrant strong mitigation.