metamzkloganc[.]gitbook[.]io

The domain metamzkloganc.gitbook.io is an active credential-theft phishing site specifically targeting users of the MetaMask cryptocurrency wallet. Analysis confirms the domain is designed to impersonate MetaMask login interfaces, capturing sensitive authentication credentials. The site remains operational as of the latest verification, with no indications of takedown or mitigation efforts. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., on April 14, 2026, and resolves to the IP address 104.18.40.47. The site is hosted on GitBook infrastructure and leverages Google Cloud Services, including Google Cloud Storage and Google Trust Services SSL certificates. Security vendors have flagged the domain as malicious, with 15 out of 95 engines on VirusTotal detecting it as a threat. The domain appears on three distinct security blocklists, and the page title, "log_in | MetâMãsk® {Login*}^," further corroborates the intent to deceive users through brand impersonation. Additional technologies detected include HSTS, Cloudflare CDN, and HTTP/3 protocol support, which may be employed to enhance the site's perceived legitimacy or evade detection. The risk level associated with this domain is classified as high due to its active status, targeted brand impersonation, and confirmed malicious detections. Users are strongly advised to avoid interacting with the domain and to verify the authenticity of any MetaMask-related communications through official channels. Organizations should update blocklists to include metamzkloganc.gitbook.io and its resolving IP address, 104.18.40.47, to prevent access. Security teams are recommended to monitor for related infrastructure, such as subdomains or newly registered domains utilizing similar naming conventions, to preempt further phishing campaigns.