matamsklogcn[.]gitbook[.]io

This domain carries a high risk level as a generic phishing site specifically designed for credential theft, impersonating the MetaMask cryptocurrency wallet login page. The site was taken offline after being flagged by security vendors and blocklists, but users who may have visited it earlier remain at risk of compromised credentials.

PhishDestroy identified this threat through multiple data points: VirusTotal shows 17 out of 95 security vendors flagging the domain as malicious. It was registered through GitBook on May 19, 2026, and resolves to IP address 104.18.40.47. The domain appears on three separate security blocklists, and Google Safe Browsing specifically flags it for phishing. The page title "M𝐞tåMäsk®us - l𝗼𝗴i𝒏* | Sign# In" uses Unicode obfuscation to mimic the legitimate MetaMask login interface, a common technique in credential theft campaigns. The SSL certificate issued by Google Trust Services (WE1) does not indicate legitimacy, as phishing sites often obtain valid certificates.

To protect against this specific threat, users should never enter their MetaMask seed phrase or password on any site accessed via unsolicited links. Always verify the URL directly in the browser's address bar—legitimate MetaMask login pages use the official domain metamask.io. Enable two-factor authentication on your MetaMask wallet and consider using a hardware wallet for additional security. If you have already entered credentials on this site, immediately transfer your funds to a new wallet and revoke any token approvals. Report the domain to phishing databases and monitor your accounts for unauthorized activity.