mettamsklogonz[.]gitbook[.]io

The domain mettamsklogonz.gitbook.io was registered via GitBook on 12 March 2026 and is currently hosting a page titled "MetaMask Login | us". The site delivers an HTTP 307 redirect and presents a TLS certificate identified as WE1. Network resolution points to the IP address 172.64.147.209, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated in the United States. Threat intelligence assigns the domain a Gridinsoft trust score of 0 out of 100 and classifies it as a crypto‑scam impersonating the MetaMask brand. Eight of ninety‑four VirusTotal scanners have flagged the domain, and it appears on three independent security blocklists. The domain is already listed by PhishDestroy, MetaMask, and SEAL as blocked, yet it remains active as of the report date. Analysts should enforce network‑level deny rules for the domain and its resolved IP, monitor for any associated C2 activity, and consider adding the host to local threat‑intel feeds. Further investigation is needed to determine the full payload or credential‑harvesting mechanisms, as the page content beyond the title has not been publicly disclosed.