metaamusk-un-wuleet[.]gitbook[.]io

This domain is flagged as a high-risk generic phishing target, with active blocking by PhishDestroy, MetaMask, and SEAL. The domain name, metaamusk-un-wuleet.gitbook.io, is a subdomain of gitbook.io and includes a string that closely resembles the MetaMask brand, suggesting an attempt to impersonate the cryptocurrency wallet service, though the exact page content has not yet been analyzed. Infrastructure analysis shows the domain resolves to IP address 172.64.147.209, which is part of Cloudflare's hosting and CDN network, and the nameservers are dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, both operated by Cloudflare. The domain was created on March 30, 2014, and is registered through Cloudflare, Inc., indicating long-standing registration but active current use for malicious purposes.

VirusTotal has scanned this domain with 91 vendors, and 0 currently flag it, but the absence of detections is not proof the domain is safe; the domain appears on 3 security blocklists, which is a concrete indicator of abuse. The domain remains active as of the report date. Defenders should treat this domain as an active threat, block it at the network and email gateway levels, and warn users, particularly crypto wallet holders, not to interact with any links from this domain. The low vendor detection rate highlights a gap in automated scanning, so manual review and user reporting are critical.

For any organization, it is recommended to add this domain to deny lists and monitor for similar subdomains under gitbook.io that may be part of a broader phishing campaign. The registration age and Cloudflare infrastructure may be used to evade reputation-based filters, so proactive blocking based on the seed identifier is advised. No further technical details about SSL certificate status, HTTP response codes, or page title are available at this time.