metauxmask-login[.]gitbook[.]io

Analysis indicates that the domain metauxmask-login.gitbook.io is an active credential phishing site targeting MetaMask users. The domain was registered on June 8, 2026, through GitBook, a platform that allows rapid deployment of documentation-style pages. Infrastructure analysis reveals the site resolves to IP address 172.64.147.209, hosted on Cloudflare infrastructure in Canada, and returns an HTTP 307 redirect status. The page title, 'Log In To Account,' aligns with credential harvesting tactics, and the domain is explicitly categorized as a credential phishing threat in available intelligence. The domain is flagged by at least three security blocklists, including PhishDestroy, MetaMask's own threat intelligence, and SEAL. Detection engines on VirusTotal report 17 of 91 vendors marking the domain as malicious, though this count reflects only a subset of available detection mechanisms. The domain employs standard web technologies, including GitBook, Google Cloud, HSTS, Google Cloud Trace, and HTTP/3, with a valid SSL certificate issued by Google Trust Services (WE1). The Gridinsoft trust score of 0/100 further corroborates the malicious classification. Defenders should treat this domain as a high-risk threat due to its active status, direct impersonation of a cryptocurrency wallet service, and confirmed presence on multiple blocklists. The use of GitBook as a hosting platform suggests the attacker leveraged a legitimate service to evade initial scrutiny, a tactic increasingly observed in phishing campaigns. While the exact content of the phishing page remains unanalyzed, the available indicators—page title, brand impersonation, and scam type—confirm its intent to harvest credentials. Network-level blocking of the domain and IP address 172.64.147.209 is recommended, alongside monitoring for related subdomains or GitBook-hosted pages impersonating MetaMask or other financial services.