metamsxqlugon[.]gitbook[.]io

The domain metamsxqlugon.gitbook.io is currently active and is being used to impersonate the MetaMask brand. The site presents a page titled “Metamask® Login - A Gateway to Secure and User | us”, which mimics legitimate authentication interfaces to harvest cryptocurrency credentials. The threat is classified as brand impersonation with a high risk rating. Infrastructure analysis shows the domain resolves to IP address 172.64.147.209, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The domain was created on March 12, 2026 and is hosted through the GitBook service, indicating the use of a legitimate publishing platform to obscure malicious intent. The HTTP response is a 307 temporary redirect, and the SSL certificate is identified as “WE1”, suggesting a generic or self‑issued certificate. Detection records indicate that eight out of ninety‑five VirusTotal scanners have flagged the domain, and Gridinsoft assigns it a trust score of 0 out of 100. The site is listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask’s own defenses, and SEAL. These multiple detections corroborate the presence of a cryptocurrency‑focused scam infrastructure targeting MetaMask users. Defenders should immediately block DNS resolution to metamsxqlugon.gitbook.io and enforce URL filtering on corporate networks. Monitoring for outbound connections to the associated IP 172.64.147.209 can help identify compromised clients. Incident response teams should advise users to verify MetaMask login URLs and to avoid entering credentials on any site that does not resolve to official MetaMask domains. Continuous threat‑intelligence feeds should be updated to include this domain and its associated indicators of compromise.