metamcak-logun[.]gitbook[.]io

This domain, metamcak-logun.gitbook.io, is actively hosting a high-risk phishing site targeting MetaMask users, as indicated by the page title 'M𝐞tåMäsk 𝗟𝗼𝗴𝗶𝗻' observed on July 12, 2026. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Cloudflare, Inc., and currently resolves to IP address 172.64.147.209. The site employs multiple technologies including GitBook, Contentful, Google Cloud, and Cloudflare, with HTTP/3 and HSTS enabled, suggesting a structured hosting environment designed to evade detection or takedown. Security vendors have flagged this domain, with 11 of 95 engines on VirusTotal identifying it as malicious. It appears on three security blocklists and has been blocked by SEAL, MetaMask's internal systems, and PhishDestroy. The SSL certificate is issued by Google Trust Services, and Gridinsoft assigns a trust score of 0/100, further indicating its malicious nature. While the exact content and functionality of the site remain unanalyzed, the page title explicitly suggests credential theft targeting MetaMask users. Defenders should treat this domain as an active threat, prioritize blocking at DNS and network levels, and monitor for related infrastructure or campaigns leveraging similar GitBook-based hosting. No evidence currently links this domain to broader phishing kits or actor infrastructure, but the use of obfuscated Unicode characters in the page title may indicate attempts to bypass automated detection systems.