metmskzlogzn[.]gitbook[.]io

Analysis indicates that the domain metmskzlogzn.gitbook.io is currently active and resolves to the IP address 104.18.40.47, which is owned by Cloudflare's edge network. The domain was registered on March 30, 2014 through Cloudflare, Inc., and uses the Cloudflare name servers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. VirusTotal reports that 5 of 91 scanning engines flag the domain as malicious, suggesting a moderate level of detection across the security community.

The domain is listed on one external blocklist and has been explicitly blocked by the PhishDestroy sinkhole, confirming that it is being used for phishing‑related activity. No public page title, brand target, or specific scam kit information is available in the current intelligence set, so the exact impersonated service cannot be confirmed at this time. The presence of Cloudflare as both registrar and hosting provider is consistent with many abuse campaigns that leverage the provider's CDN to obscure origin infrastructure.

Defenders should continue to block DNS resolution for the domain and add the IP address 104.18.40.47 to network deny lists, while monitoring for any new indicators that may reveal the targeted brand or payload. Because the domain remains active, continuous observation of its traffic patterns and any future VirusTotal or blocklist updates is recommended to adjust remediation measures promptly.