meixmetalogiin[.]gitbook[.]io

Analysis of meixmetalogiin.gitbook.io indicates active brand impersonation targeting MetaMask, a cryptocurrency wallet service. The domain, registered through Cloudflare, Inc. on March 30, 2014, currently resolves to IP 104.18.40.47, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), and the domain uses Cloudflare nameservers (dahlia.ns.cloudflare.com, hugh.ns.cloudflare.com). The page title, 'The Benefits of Logging In with Metamask | us,' directly references MetaMask, aligning with the classified scam type of crypto fraud. As of July 12, 2026, the domain remains active, returning an HTTP 307 status code, which may indicate temporary redirection or proxy behavior. Security vendor detections are present but limited: 11 of 95 engines on VirusTotal flag the domain, and it appears on at least one security blocklist. Gridinsoft assigns a trust score of 0/100, further suggesting malicious intent. The long-standing registration date (over a decade) does not mitigate risk, as threat actors frequently abuse legitimate infrastructure or repurpose older domains. No evidence confirms whether this is a credential-harvesting page, a crypto drainer, or another form of fraud, as the exact content remains unanalyzed. Defenders should treat this domain as high-risk due to confirmed brand impersonation, crypto scam classification, and active security vendor detections. Immediate blocking at the DNS or network layer is recommended. Monitoring for associated IP or certificate reuse may help identify related campaigns. Further investigation into redirection chains or backend infrastructure could clarify the attack methodology, but current evidence justifies proactive mitigation.