metamskxtnsn[.]gitbook[.]io

Analysis as of July 22, 2026 indicates that the domain metamskxtnsn.gitbook.io is actively used in a generic phishing campaign. The domain is registered through Cloudflare, Inc., and its authoritative nameservers are dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, which are typical of Cloudflare‑hosted services. DNS resolution points to the IP address 172.64.147.209, an address owned by Cloudflare’s global edge network, providing anonymity for the underlying operator. The domain appears on one public security blocklist and is listed as blocked by PhishDestroy, reinforcing the classification as malicious.

VirusTotal scans show that four of ninety‑five security vendors have flagged the domain, suggesting that at least a subset of detection engines have identified phishing‑related activity. The domain was created on March 30, 2014 and remains active, indicating a long‑standing infrastructure that may have been repurposed for recent abuse. No additional evidence such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts is available in the current intelligence set, leaving the exact content and target of the phishing lure undocumented.

Consequently, defenders cannot confirm which brands or credential‑collection pages are being mimicked, but the presence of multiple detections and blocklist listings provides sufficient confidence to treat the domain as high‑risk. Recommended mitigation steps include adding the domain to network‑level deny lists, updating URL filtering rules to block any HTTP or HTTPS requests to metamskxtnsn.gitbook.io, and monitoring outbound traffic for connections to the associated Cloudflare IP address. Security teams should also share the indicator with threat‑intelligence sharing platforms to improve collective detection, and continue to watch for any changes in the domain’s reputation or additional detections from scanning services.