memetamskxten[.]gitbook[.]io

Analysis indicates that memetamskxten.gitbook.io is an active phishing domain impersonating MetaMask, a cryptocurrency wallet service. The domain was registered on May 12, 2026, and remains operational as of July 12, 2026. Infrastructure analysis reveals hosting behind Cloudflare (IP 104.18.40.47, Canada), with technologies including GitBook, Google Cloud, and HSTS. The page title, 'Getting started with MetáMάsk® | Extėnsion_us*,' contains deliberate Unicode character substitutions to mimic the legitimate MetaMask brand, a common tactic in credential-harvesting schemes. Security vendors have flagged the domain, with 8 of 92 engines on VirusTotal detecting malicious activity. It appears on three blocklists, including PhishDestroy, MetaMask’s own protections, and SEAL. The domain’s Gridinsoft trust score is 0/100, further supporting its classification as high-risk. The HTTP 307 redirect status suggests dynamic behavior, potentially used to evade detection or route victims to fraudulent login pages. While the exact content of the site has not been analyzed, the combination of brand impersonation, Unicode spoofing, and security vendor detections strongly indicates a phishing login scam targeting MetaMask users. Defenders should treat this domain as malicious, block access, and monitor for related infrastructure (e.g., GitBook subdomains, Cloudflare IPs) in their environments. No legitimate MetaMask resources are hosted on this domain, and users should be warned against entering credentials or interacting with it.