mietamaskluogin[.]gitbook[.]io

This domain, mietamaskluogin.gitbook.io, is actively flagged as a high-risk brand impersonation targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the domain was registered on March 30, 2014, though its current malicious activity appears to be a more recent development. The page title explicitly replicates MetaMask branding, displaying "MetaMask Login | Wallet - MetaMask - Blockchain Wallet | Login," which aligns with the reported threat type of brand impersonation. The domain resolves to IP address 172.64.147.209 and is hosted behind Cloudflare infrastructure, a common tactic to obscure origin servers and evade takedowns. Security vendor detection on VirusTotal shows 12 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist. The domain is also blocked by PhishDestroy, further corroborating its classification as a phishing resource. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy given the prevalence of free and automated certificate issuance. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk. What remains uncertain is the exact method of credential harvesting or payload delivery, as the site content has not been directly analyzed. However, the combination of MetaMask branding in the page title, the domain’s presence on security blocklists, and vendor detections strongly suggests an intent to deceive users into submitting wallet credentials or other sensitive information. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS or network level. Security teams are advised to monitor for connections to 172.64.147.209 and review logs for any interaction with this domain, particularly from systems associated with cryptocurrency transactions or wallet management.