mtamassk-walllat[.]gitbook[.]io

This domain is flagged as a high-risk crypto scam impersonating the MetaMask brand. The page title contains unicode obfuscation of the MetaMask login interface, a common tactic to evade text-based detection. The domain was created on March 30, 2014, but its current malicious use is recent and active as of July 12, 2026. It is hosted behind Cloudflare infrastructure (AS13335) with an IP address of 172.64.147.209 located in the United States, and uses Cloudflare nameservers. The SSL certificate is issued by Google Trust Services. VirusTotal data shows 8 out of 95 security vendors flagging the domain as malicious. The domain also appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0 out of 100. The HTTP response returns a 307 redirect, which may be used to route victims through multiple stages before reaching the phishing page. The exact content of the landing page has not been visually analysed, but the title strongly indicates a fake MetaMask login portal designed to harvest credentials or seed phrases. Defenders should block this domain at the DNS and web gateway level, flag any emails or messages containing links to this domain, and monitor for related subdomains or variations on the gitbook.io platform. Users who may have visited this site should be advised to rotate their MetaMask credentials immediately and enable hardware-based two-factor authentication where possible.