mxtamaseklogxn[.]gitbook[.]io

This domain is flagged as a high-risk fake login portal specifically designed to harvest cryptocurrency wallet credentials. Analysis indicates the page impersonates MetaMask, a widely used cryptocurrency wallet interface, with the intent to deceive users into submitting sensitive authentication details. The threat type is classified as a crypto credential harvester, a subset of phishing attacks targeting digital asset theft through fraudulent login interfaces. Infrastructure analysis reveals multiple high-risk indicators. The domain mxtamaseklogxn.gitbook.io was registered on April 07, 2026, through Cloudflare, Inc., and resolves to the IP address 104.18.40.47, which is geolocated in Canada and associated with Cloudflare’s network. The domain appears on three security blocklists and is flagged by 17 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic in both legitimate and malicious domains leveraging CDN infrastructure. The page title, “𝗠𝗲𝘁å𝗺å𝘀𝗸 𝗟𝗼𝗴𝗶𝗻,” uses Unicode characters to mimic the legitimate MetaMask brand, a tactic employed to evade basic detection mechanisms and increase perceived authenticity. Mitigation steps for this specific threat type include immediate domain blocking at the network and endpoint levels. Organizations should update security policies to flag domains registered through Cloudflare with recent creation dates and Unicode-based brand impersonation in page titles. End users should be advised to verify the legitimacy of MetaMask login portals by cross-referencing the URL with the official domain and checking for HTTPS certificate transparency logs. In cases of exposure, affected users should revoke active wallet sessions, transfer assets to a new wallet, and monitor transaction logs for unauthorized activity. Security teams are recommended to conduct retrospective analysis for any prior interactions with this domain or its associated IP address.