metamzklganq[.]gitbook[.]io

Analysis indicates that the domain metamzklganq.gitbook.io was registered on 2026-03-14 and is currently hosted on Cloudflare's network (AS13335) with the IP 104.18.40.47 located in the United States. The site serves content over HTTPS using a Google Trust Services certificate (WE1) and enforces HSTS. Traffic is routed through Cloudflare and Google Cloud services, including Cloudflare’s HTTP/3 support, Google Cloud Trace, and Google Cloud Storage. The page title returned by the server is 'Login_us | M𝐞tåMäsk® !login - @us', which explicitly references the MetaMask brand, confirming a credential‑phishing impersonation of MetaMask. The domain appears on three public blocklists (PhishDestroy, MetaMask, SEAL) and has a Gridinsoft trust score of 0/100. VirusTotal scans show 12 of 94 security vendors flag the domain, reinforcing its malicious reputation. The HTTP response is a 307 redirect, but the final landing page content has not been captured. No additional infrastructure such as command‑and‑control servers or malware payloads has been observed. Defenders should block DNS resolution for the domain, enforce TLS inspection to capture the redirect chain, and add the domain to internal deny lists. Monitoring for similar GitBook‑hosted phishing sites targeting crypto wallets is recommended, as the use of cloud‑based authoring platforms can bypass traditional URL reputation services.