metamsakwallct[.]gitbook[.]io

The domain metamsakwallct.gitbook.io is identified as a crypto drainer phishing infrastructure, currently offline. This domain targeted cryptocurrency wallet users by simulating legitimate interfaces to drain funds from connected wallets. Analysis indicates the domain was operational until recent takedown efforts disrupted its activity. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating widespread detection of malicious intent. It was hosted on GitBook’s platform, resolving to the IP address 104.18.40.47, which is associated with Cloudflare, Inc. in California. The domain was registered on May 23, 2026, and appeared on three security blocklists. Its SSL certificate, issued by Google Trust Services (WE1), provided a false sense of legitimacy to potential victims. The domain’s inclusion on multiple blocklists, including those maintained by cryptocurrency security entities, further corroborates its malicious classification. As of the latest assessment, metamsakwallct.gitbook.io has been taken offline, reducing immediate risk to users. However, similar infrastructure may re-emerge under different domains. Users are advised to verify wallet connections against official sources, employ hardware or multi-signature wallets for high-value transactions, and monitor for unauthorized access. Security teams should update blocklists to include this domain and its associated indicators, such as the IP address 104.18.40.47, to prevent future exposure.