metamosklogex[.]gitbook[.]io

Analysis of the domain metamosklogex.gitbook.io indicates it is an active credential phishing campaign targeting users of the MetaMask cryptocurrency wallet. The domain was registered on May 11, 2026, through GitBook, a platform commonly used for documentation hosting, which has been exploited in this instance to lend superficial legitimacy to the phishing page. The page title, '𝗠𝗲𝘁å𝗺å𝘀𝗸 𝗟𝗼𝗴𝗶𝗻,' directly impersonates MetaMask, employing Unicode character substitution to evade basic detection mechanisms. Infrastructure analysis reveals the domain resolves to the IP address 172.64.147.209, geolocated in Canada and associated with Cloudflare, Inc. The use of Cloudflare is consistent with phishing campaigns seeking to obfuscate backend infrastructure and leverage its SSL capabilities. The site employs a valid SSL certificate issued by Google Trust Services (WE1), further attempting to appear legitimate. Technologies detected include GitBook, Google Cloud, Cloudflare, and HTTP/3, with HSTS enforced, likely to reinforce the illusion of security. As of July 12, 2026, the domain remains active and is flagged by 15 of 91 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. The HTTP status code 307, indicating a temporary redirect, may be used to obscure the final phishing endpoint or evade automated crawlers. Defenders should treat this domain as high-risk. The combination of brand impersonation, Unicode obfuscation, and exploitation of a legitimate hosting platform underscores the sophistication of this campaign. Network-level blocking of the IP 172.64.147.209 and domain-level filtering are recommended. End-users should be alerted to the presence of Unicode spoofing in the page title as a red flag. Further investigation into the GitBook account associated with this domain may reveal additional malicious pages or infrastructure.