metamasksso[.]gitbook[.]io

PhishDestroy identifies metamasksso.gitbook.io as an active brand impersonation site targeting MetaMask users through fake SSO claims. The domain uses a deliberately misleading subdomain and page title (Metamask extension | us) to deceive visitors into downloading malicious extensions or surrendering credentials. This elevated-risk site leverages Cloudflare’s infrastructure to obscure its origin while maintaining HTTPS trust through Google Trust Services, a tactic observed in credential phishing campaigns against cryptocurrency users.

This domain was flagged by 6 out of 95 VirusTotal security vendors at last inspection, indicating partial but not universal detection. It resolves to IP 172.64.147.209 via Cloudflare, Inc (registered March 30, 2014) — an unusually long-standing domain repurposed for fraud. The page title explicitly mimics MetaMask’s official branding, and the presence of a fake SSO portal suggests a targeted attempt to harvest login credentials under the guise of a legitimate MetaMask extension. The low absolute detection rate (6/95) combined with high infrastructure trust (Google Trust Services SSL, Cloudflare CDN) increases risk of successful deception.

To mitigate exposure, users should avoid clicking links from unsolicited messages claiming to be MetaMask SSO. Always verify the domain at the official site (metamask.io) and use browser extensions or security tools that detect impersonation pages. Organizations should add this domain to network blocklists and educate teams on recognizing SSO-themed phishing lures. Report suspected phishing attempts to MetaMask’s official security channels to aid in takedown efforts.