metamasksso[.]gitbook[.]io

metamasksso.gitbook.io is a subdomain of gitbook.io. PhishDestroy first recorded this hostname on Apr 14, 2026. The hostname explicitly references MetaMask; stored content metadata identifies the same apparent target. The stored content classification is brand impersonation. The assembled evidence scores 100/100 (critical).

Four independent sources are positive: VirusTotal, MetaMask, SEAL, and URLScan. VirusTotal recorded 13 detections among 91 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Fortinet, G-Data, Lionic, Sophos, VIPRE, Webroot on Jul 27, 2026 at 03:05 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. URLScan returned a malicious verdict with score 100. The evidence is not unanimous. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on Apr 14, 2026 at 14:41 UTC. PhishStats returned no feed match on Apr 14, 2026 at 14:42 UTC.

Cloaking was recorded with HTTP 307 on Aug 7, 2026 at 10:02 UTC. Registration records for the registrable domain gitbook.io list Cloudflare, Inc as the registrar and Apr 14, 2026 as the creation date. Registration preceded first observation by 0 days. At collection time, the hostname resolved to 172.64.147.209 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. Captured page title: “Metamask extension | us”. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:06 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Google Trust Services as the certificate issuer with validity through Aug 17, 2026; checked Jul 9, 2026 at 01:00 UTC.

Taken together, the page content and independent findings support classifying this hostname as MetaMask-themed brand impersonation.