metamzklogoo[.]gitbook[.]io

This domain, metamzklogoo.gitbook.io, is actively flagged as a high-risk brand impersonation targeting MetaMask. Analysis indicates the page title explicitly references MetaMask with altered characters (MetâMãsk® #login), a common tactic to evade basic detection while maintaining visual similarity to the legitimate brand. The domain was created on March 30, 2014, but this long registration history does not correlate with trustworthiness, as GitBook-based pages can be rapidly deployed under pre-existing domains. Infrastructure analysis reveals the use of Cloudflare (resolving to 104.18.40.47), Google Trust Services SSL certificates, and GitBook hosting, which are legitimate services often abused for phishing due to their widespread use and perceived credibility. Security vendors have flagged this domain, with 19 out of 95 engines on VirusTotal detecting it as malicious. It appears on three security blocklists and is explicitly blocked by MetaMask’s own protection systems, reinforcing its classification as a targeted threat. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. While the exact content and functionality of the page remain unanalyzed, the combination of brand impersonation, blocklist presence, and vendor detections provides sufficient evidence for defenders to treat this domain as malicious. Defenders should immediately block this domain at the network and endpoint levels, prioritize it for takedown requests, and monitor for related infrastructure (e.g., GitBook subdomains, Cloudflare-hosted pages) that may reuse the same tactics. Given the active status and high-risk classification, assume this domain is part of an ongoing campaign targeting cryptocurrency users.