metmsklogcn[.]gitbook[.]io

This domain is flagged as a high-risk brand impersonation threat targeting MetaMask users. Analysis indicates the site is designed to harvest login credentials, potentially enabling unauthorized access to cryptocurrency wallets and subsequent asset theft. The infrastructure mimics legitimate MetaMask login portals, increasing the likelihood of successful deception among users seeking wallet management tools. Infrastructure analysis reveals the domain metmsklogcn.gitbook.io was registered through Cloudflare, Inc on March 30, 2014, though recent malicious activity suggests compromise or repurposing. It resolves to IP address 104.18.40.47 and is currently offline. Security vendors on VirusTotal flagged the domain at a 16/95 detection rate, while it appears on three security blocklists. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Mitigation requires immediate action from both users and security teams. Users who may have interacted with this domain should revoke any active MetaMask sessions, reset passwords, and review connected applications for unauthorized access. Security teams should block the domain and its resolving IP (104.18.40.47) at the network level, while monitoring for similar impersonation patterns targeting cryptocurrency services. Wallet providers should implement additional verification steps for login attempts, such as multi-factor authentication or hardware-based confirmation, to mitigate credential theft risks. Organizations should also educate users on identifying fraudulent login portals, particularly those hosted on third-party documentation platforms like GitBook.