metamkzlgano[.]gitbook[.]io

Analysis of metamkzlgano.gitbook.io indicates a high‑risk credential phishing campaign targeting the MetaMask brand. The domain, registered on May 09, 2026 through the GitBook platform, resolves to IP address 104.18.40.47, a Cloudflare‑managed host located in Canada. The site presents a TLS certificate issued by Google Trust Services (WE1), and HTTP traffic is served over HTTP/3 with a 307 redirect response. The page title observed—"M𝐞tåMäsk® | Login_US | SignIN | US-LOGIN^*"—explicitly references MetaMask, confirming brand impersonation. Infrastructure reputation is poor, with a Gridinsoft trust score of 0/100 and 17 of 92 VirusTotal scanners flagging the domain. It is currently listed on three external blocklists and is actively blocked by PhishDestroy, MetaMask’s own defenses, and SEAL. No additional payload or post‑login behavior has been publicly disclosed, so the full extent of credential capture mechanisms remains uncertain. Defenders should immediately block the domain and its associated IP at network perimeters, monitor DNS queries for the host, and incorporate the domain into internal phishing‑detection signatures. Continuous observation of related GitBook subdomains is advised, as the registration method suggests a low‑cost, disposable hosting approach that could be reused for future impersonation campaigns.