metmskzlgen[.]gitbook[.]io

The domain metmskzlgen.gitbook.io is currently active and has been classified as a high‑risk generic phishing site. VirusTotal records show that 6 of 95 scanned security vendors flag the domain, and Google Safe Browsing lists it under the SOCIAL_ENGINEERING category. The site appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL, indicating that multiple defensive feeds have observed malicious use.

Infrastructure analysis reveals that the domain resolves to the IP address 172.64.147.209, which belongs to Cloudflare, Inc. The hosting location is identified as Canada. The domain is served over HTTPS using a certificate issued by Google Trust Services / WE1, and HSTS is enforced. Detected technologies include GitBook, Google Cloud services, Cloudflare edge, HTTP/3, and Google Cloud Trace, suggesting the site leverages a legitimate documentation platform to hide its malicious front end.

The landing page presents a title “M𝐞tåMäsk® - Login | $ign In”, mimicking the login interface of a popular cryptocurrency wallet extension. The visual design and wording are crafted to lure users into entering their seed phrase or private key, which would then be harvested by the attacker. No additional malicious payloads have been observed, but the credential‑harvesting intent is clear from the page content and the blocklist classifications.

Defenders should block DNS resolution for metmskzlgen.gitbook.io and any sub‑domains, enforce network‑level filtering of the associated IP address, and monitor for outbound connections to Cloudflare edge nodes that match the observed fingerprint. End‑user awareness training should emphasize the risk of entering wallet credentials on unofficial documentation sites. Ongoing monitoring is required because the operator may relocate the phishing front end to other GitBook‑hosted domains or alter the page content without notice.