metmskloggn[.]gitbook[.]io

As of July 12, 2026, the domain metmskloggn.gitbook.io has been confirmed as a phishing login site impersonating MetaMask, a popular cryptocurrency wallet. This domain is currently active and has been flagged by multiple security blocklists, including PhishDestroy and SEAL, enhancing the credibility of the threat. The domain was created on May 12, 2026, and is hosted by GitBook, a platform often misused for hosting malicious content due to its ease of use and low cost. The domain resolves to an IP address (172.64.147.209) located in California, United States, and is managed by Cloudflare, Inc., which may indicate the use of CDN services to mask the true origin of the threat. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. Analysis indicates that the page title 'MetaMask® - Login | Login' is designed to mimic the legitimate MetaMask login page, thereby increasing the likelihood of user deception. The site's HTTP status of 307 suggests that it is actively redirecting traffic, possibly to further obfuscate its malicious intent or to serve different content based on user interaction. The Gridinsoft trust score of 0/100 underscores the domain's highly suspicious nature, and the fact that it is blocked by MetaMask and other security vendors further confirms its malicious purpose. Defenders should immediately block this domain and educate users about the risks of phishing attacks targeting cryptocurrency wallets. Regular monitoring and updates to security blocklists are recommended to prevent unauthorized access and protect user credentials.