mitamxskloggnn[.]gitbook[.]io

The domain mitamxskloggnn.gitbook.io is confirmed to operate as a credential theft site specifically targeting MetaMask wallet users. Analysis indicates the site impersonates the official MetaMask login interface, presenting a fraudulent page titled 'M𝐞tåMäsk® $Login* | Sign_In* To Account' to deceive victims into submitting sensitive account credentials. The domain is currently offline, but prior activity aligns with known patterns of crypto wallet phishing campaigns. Infrastructure analysis reveals the domain was hosted on GitBook, a platform frequently abused for phishing due to its free hosting capabilities. The site resolved to IP address 104.18.40.47 and employed technologies including Cloudflare, Google Cloud Storage, and HSTS, which are commonly used to obfuscate malicious activity. Security vendors flagged the domain in 14 of 95 VirusTotal scans, while Gridinsoft assigned a trust score of 0/100. The domain appears on three independent security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate was issued by Google Trust Services, providing a false sense of legitimacy. Current status indicates the domain has been taken offline, though threat actors may attempt to resurface under a different alias. Users who accessed this domain should immediately revoke any active sessions, reset credentials, and enable multi-factor authentication on their MetaMask accounts. Organizations are advised to block the domain and associated IP (104.18.40.47) at the network level, monitor for similar GitBook-hosted phishing attempts, and educate users on identifying impersonation tactics targeting crypto wallet logins. Historical indicators should be preserved for forensic analysis in the event of future incidents.