metmsklogon[.]gitbook[.]io

The domain metmsklogon.gitbook.io has been identified as a high-risk brand impersonation site targeting MetaMask. It features a suspicious page title, 'M𝐞tåMäsk® | #𝑺î𝗀𝒏 i𝒏 - Log_In', which suggests an attempt to falsely represent MetaMask and lure users into compromising their credentials. The domain was created on May 9, 2026, and is actively flagged by Google Safe Browsing for social engineering. A thorough analysis indicates potential malicious intentions behind this domain.

Infrastructure analysis reveals that the domain resolves to the IP address 172.64.147.209, registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may falsely imply legitimacy to unsuspecting users. However, the overall trust score from Gridinsoft is alarmingly low at 0/100, indicating a high likelihood of malicious activity. Additionally, this domain appears on three separate security blocklists, with notable blocklist providers including SEAL and PhishDestroy, strengthening the case for its fraudulent nature.

Security assessments using VirusTotal show that 13 out of 95 security vendors have flagged this domain, further corroborating its association with potential phishing attempts. Organizations and individuals should exercise caution and refrain from engaging with this domain as it impersonates a well-known brand, heightening the risk of credential theft.

Defenders should consider blocking this domain across their networks and educating users on the dangers associated with brand impersonation. Continuous monitoring of such domains is essential, as their infrastructure can evolve or change rapidly. Efforts to take down or report the domain to appropriate authorities may help mitigate the risk it poses to the brand and its users.