metamkzlogzon[.]gitbook[.]io

This domain, metamkzlogzon.gitbook.io, is identified as a confirmed brand impersonation site targeting MetaMask, a widely used cryptocurrency wallet service. The site presents itself as a legitimate MetaMask login portal, employing visual and textual elements designed to deceive users into disclosing sensitive credentials. Analysis indicates this is a deliberate attempt to harvest crypto wallet access details, potentially leading to unauthorized transactions or asset theft. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 30, 2014, though recent activity suggests repurposing for malicious intent. It resolves to the IP address 172.64.147.209 and employs multiple cloud-based technologies, including GitBook, Google Cloud services, and Cloudflare’s content delivery network. Security vendors have flagged the domain, with 17 out of 95 VirusTotal engines detecting malicious behavior. The site appears on one security blocklist, and its Gridinsoft trust score is 0 out of 100, reinforcing its elevated risk classification. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to fraudulent sites. As of the latest assessment, metamkzlogzon.gitbook.io has been taken offline, likely due to detection and mitigation efforts. However, users who interacted with the site prior to its removal may remain at risk. It is recommended that individuals who entered credentials on this domain immediately revoke access to any associated crypto wallets, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address, while security teams are advised to conduct retrospective analysis to identify any prior compromise indicators within their networks.