methadfmscklogon[.]gitbook[.]io

The domain methadfmscklogon.gitbook.io is actively hosting a brand-impersonation page targeting MetaMask users. The page title returned by the server is "MetaMask® - Login | us," indicating a deliberate attempt to lure victims into providing credentials. Infrastructure analysis shows the site is served through Cloudflare, Inc., using the nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, and resolves to IP address 104.18.40.47, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 trust chain, and HTTP/3 is enabled, suggesting a modern delivery stack. An HTTP 307 response code is observed, implying a temporary redirect, but the final landing page continues to present the MetaMask login façade. The domain was created on March 30, 2014, and despite its age, it remains active as of the report date. VirusTotal scans have flagged the domain by 14 of 95 security vendors, and the domain appears on at least one security blocklist. PhishDestroy has already added the domain to its blocklist, and the Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification. The threat vector aligns with a crypto‑related scam, leveraging MetaMask brand trust to harvest private keys or seed phrases. Defenders should update web filtering and DNS block lists to include methadfmscklogon.gitbook.io, enforce strict outbound traffic controls for connections to Cloudflare‑hosted IPs that resolve to this domain, and monitor for any credential leakage associated with MetaMask users. Continuous threat‑intel feeds should be consulted for any emerging indicators of compromise linked to this infrastructure.