sso--app-metamask[.]gitbook[.]io

sso--app-metamask.gitbook.io is an active phishing domain engaged in brand impersonation targeting MetaMask users, as identified by PhishDestroy. This domain poses an elevated risk due to its deceptive resemblance to MetaMask's official authentication infrastructure, potentially leading to credential theft or crypto asset drainage.

This domain exhibits multiple red flags consistent with malicious intent. It resolves to IP address 172.64.147.209 and is flagged by 10 out of 95 VirusTotal security vendors. Registered through Cloudflare, Inc., the domain was created on March 30, 2014, and appears on at least 2 public security blocklists. Despite hosting on a Cloudflare proxy, the domain employs a Google Trust Services SSL certificate, which does not inherently guarantee legitimacy. MetaMask and the SEAL security community have both blacklisted this domain, reinforcing its malicious classification.

Users must treat this domain with extreme caution. To mitigate risk, avoid interacting with the site entirely—never enter login credentials or connect crypto wallets. Verify all URLs by cross-referencing them with MetaMask's official domain (metamask.io) through a trusted source. Employ browser security extensions (e.g., uBlock Origin, MetaMask’s built-in phishing detection) or network-level blocklists (e.g., Pi-hole) to block access. If accidental exposure occurs, immediately revoke any connected wallet permissions and rotate credentials. Report suspicious domains to MetaMask’s phishing team or security platforms like PhishDestroy to aid collective defense.