metamasklusf[.]gitbook[.]io

The domain metamasklusf.gitbook.io is currently listed as an active crypto‑drainer infrastructure. Registration information shows the site was created through the GitBook service, a platform that provides free hosting for documentation sites. The domain has been blocked by the PhishDestroy sinkhole and appears on one public security blocklist, indicating that defensive feeds are already distributing its indicator. HTTP probing returns a 307 temporary redirect, which may be used to forward victims to a malicious payload host. VirusTotal scans have returned six detections out of ninety‑five AV engines, confirming that multiple security products consider the site malicious. No additional intelligence such as ASN, hosting country, or associated malware kit has been published, so the broader command‑and‑control layout remains uncertain. Defenders should continue to block the domain at perimeter filters, update URL blocklists, and monitor for any traffic redirects that may arise from the 307 response. Because the site is still active, ongoing observation is recommended to capture any changes in hosting or payload delivery mechanisms.