metxmscklogenz[.]gitbook[.]io

PhishDestroy identifies a live phishing page hosted at metxmscklogenz.gitbook.io designed to steal Metamask credentials. The page title—M𝐞tåMäsk® % Login* | {Sign_In*}—uses obfuscated characters to mimic the legitimate Metamask brand and lure victims into entering their wallet passwords and seed phrases. Once submitted, the credentials are sent to attacker-controlled servers, giving fraudsters full control over victims’ cryptocurrency holdings. This domain was flagged by 18 out of 95 VirusTotal security vendors and is already blocked by OpenPhish. It was registered through Cloudflare, Inc. on March 30, 2014, and resolves to IP 104.18.40.47. Despite the age of the domain, its current content is actively malicious and leverages the GitBook platform to host the fraudulent login page under a valid Google Trust Services SSL certificate, adding a veneer of legitimacy to deceive users. If you visited metxmscklogenz.gitbook.io and entered any credentials, immediately revoke wallet access via your Metamask settings, transfer remaining funds to a new wallet, and scan your device with updated antivirus software. Report the incident to Metamask support and change passwords used on the same device. Avoid clicking links in unsolicited messages and always verify URLs before entering sensitive data.