metamsaklogno-usa[.]gitbook[.]io

The domain metamsaklogno-usa.gitbook.io is currently active and has been identified as a high-risk brand impersonation threat targeting MetaMask. Analysis reveals that the page title prominently displays "𝗠𝗲𝘁å𝗺å𝘀𝗸 𝗟𝗼𝗴𝗶𝗻 - Log In To Account (official)", which aims to mislead users into believing they are interacting with legitimate services. The domain is resolving to the IP address 104.18.40.47, and its registration through Cloudflare, Inc. suggests the use of a well-known CDN provider for legitimacy masking purposes.

The domain was created on March 30, 2014, and it has since been flagged by multiple organizations. Notably, it has been blocked by SEAL, MetaMask, and PhishDestroy, indicating a recognized threat within the security community. Furthermore, the domain has a poor trust score of 0 out of 100 as reported by Gridinsoft, which signifies the high likelihood of it being associated with malicious activities. Security analysis from VirusTotal reveals that 14 out of 95 security vendors have flagged this domain as suspicious, further corroborating its potentially harmful nature.

The domain leverages various technologies to enhance its credibility, including GitBook for content hosting and Cloudflare for distribution. The presence of an SSL certificate issued by Google Trust Services adds an additional layer of deception, as it may give users an unwarranted sense of security. Additionally, it is listed on three separate security blocklists and exhibits features commonly associated with phishing infrastructure, such as HSTS and HTTP/3.

Defenders are advised to raise awareness about this domain and implement measures such as user education on recognizing phishing attempts. Additionally, monitoring tools and threat intelligence feeds should be configured to track this domain and similar threats actively. Given its established presence and targeting of a recognized brand, ongoing vigilance is critical to mitigate risks associated with this impersonation attempt.