webp--metsamask[.]gitbook[.]io

Analysis indicates that the domain webp--metsamask.gitbook.io remains active as of 12 July 2026. It was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 104.18.40.47 located in the United States under AS13335. Google Safe Browsing classifies the site under the SOCIAL_ENGINEERING category, and 14 of 95 VirusTotal scanners have flagged it. The domain carries a Google Trust Services / WE1 SSL certificate, and HTTP requests return a 403 status, suggesting intentional denial of direct content retrieval.

Infrastructure analysis reveals that the domain is served exclusively by Cloudflare’s network, using the nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The presence of HTTP/3 indicates modern protocol support, while the 403 response prevents casual browsing but does not preclude targeted exploitation. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, confirming its low reputation across multiple detection engines.

Evidence beyond the observed flags is limited. No page content has been captured, and the exact phishing payload or credential‑harvesting mechanism has not been disclosed. The classification as generic_phishing derives from the combination of Google Safe Browsing’s SOCIAL_ENGINEERING label and the multi‑vendor flags, but the specific lure or impersonated brand cannot be confirmed without further content analysis.

Defenders should prioritize immediate mitigation. The domain should be added to web‑filter and DNS blocklists, and any outbound connections to 104.18.40.47 should be monitored or denied where feasible. Continuous surveillance of Cloudflare‑related traffic is advised, as the infrastructure could be reused for additional malicious sites. Incident response teams should also query threat‑intel feeds for any emerging indicators tied to this domain and consider sinkholing the IP address if operationally appropriate.