metamazkaxtn[.]gitbook[.]io

This domain, metamazkaxtn.gitbook.io, is an active phishing infrastructure targeting MetaMask users, first registered on March 30, 2014, and currently hosted on Cloudflare nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. Infrastructure analysis reveals the domain resolves to IP address 172.64.147.209, a Cloudflare-hosted endpoint, which is consistent with threat actors leveraging CDN services to obscure origin servers. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask's internal systems, and the SEAL anti-phishing initiative, indicating confirmed malicious activity. VirusTotal telemetry shows 10 of 91 security vendors flagging the domain as malicious, though the specific detection rules or payloads are not detailed in available intelligence.

The domain is hosted on GitBook's platform, a legitimate documentation service often abused for phishing due to its free tier, customizable subdomains, and SSL support. No HTTP response codes, SSL anomalies, or page titles are provided in the current dataset, leaving the exact content or phishing kit uncertain. However, the presence of MetaMask in the blocklist data suggests the site likely impersonates the MetaMask wallet interface or related cryptocurrency services to harvest credentials or private keys. The registration date of 2014 predates the widespread abuse of GitBook for phishing, but this may reflect the original creation of the gitbook.io parent domain rather than the subdomain's malicious use, which could have been repurposed at any point.

Defenders should treat this domain as high-risk due to its confirmed blocklist status, association with a known phishing target (MetaMask), and active resolution. Network-level blocking of 172.64.147.209 and the domain itself is recommended, alongside monitoring for related subdomains under gitbook.io that may follow similar naming patterns.