mettusmsklogenx[.]gitbook[.]io

Analysis of the domain mettusmsklogenx.gitbook.io indicates it is actively employed in a generic phishing campaign. The domain was created on March 30, 2014 and registered through Cloudflare, Inc., a registrar that often provides privacy shielding, making attribution to a specific entity difficult. DNS resolution continues to point to the IPv4 address 104.18.40.47, hosted on Cloudflare’s edge network and served by the authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. Reputation profiling shows the domain is present on three public security blocklists, and it is explicitly blocked by the PhishDestroy, MetaMask, and SEAL blocklists, reinforcing its classification as malicious. A VirusTotal assessment reports six positive detections out of ninety‑five antivirus engines, demonstrating that a minority of scanners have identified malicious characteristics associated with the domain. No additional metadata such as page title, SSL certificate parameters, HTTP status codes, or Safe Browsing verdicts is supplied, leaving the exact content, landing page behavior, and credential‑harvesting mechanisms unconfirmed. The combination of persistent DNS resolution, blocklist inclusion, and multi‑vendor detections elevates the risk posture to high. Defensive recommendations include adding mettusmsklogenx.gitbook.io to both inbound and outbound web filtering deny lists, ensuring that network security appliances reference the PhishDestroy, MetaMask, and SEAL blocklists, and configuring DNS monitoring to alert on queries to the IP address 104.18.40.47. Organizations should also consider tightening outbound email filters to prevent users from receiving messages that could contain links to this domain, and conduct periodic re‑scans to capture any new indicators that may emerge as the site evolves.