mymetamskwalat[.]gitbook[.]io

Analysis of mymetamskwalat.gitbook.io shows a high‑risk brand‑impersonation campaign targeting MetaMask users. The domain was registered on May 09 2026 via Cloudflare, Inc., and resolves to the Cloudflare IP 104.18.40.47 located in Canada. DNS resolution uses the Cloudflare nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The site presents an HTTP 307 redirect and serves a TLS certificate issued by Google Trust Services under the label WE1, indicating use of Google infrastructure. Page metadata reveals the title “MetáMάsk® | Wället | MetáMάsk® - Wållet^”, confirming the intent to mimic the MetaMask brand. Technology fingerprints include GitBook, Google Cloud services, HSTS, Google Cloud Trace, Cloudflare, HTTP/3, and Google Cloud Storage, consistent with a hosted documentation page repurposed for malicious activity. Security telemetry reports that 13 of 92 VirusTotal scanners flagged the domain, and it appears on three blocklists maintained by PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 0 / 100. Current evidence suggests the domain is actively used for brand‑impersonation; however, the exact payload or credential‑collection mechanism has not been observed publicly. Defenders should block the domain at network perimeters, add it to host‑based allow‑lists, monitor for outbound connections to IP 104.18.40.47, and update detection rules to flag HTTP 307 responses from this host. Continuous monitoring for new indicators of compromise is advised, as threat actors may evolve the content while retaining the same infrastructure.