metamzklvgan[.]gitbook[.]io

PhishDestroy identifies metamzklvgan.gitbook.io as an active crypto drainer domain posing under active investigation. This site attempts to trick visitors into connecting cryptocurrency wallets under the guise of legitimate GitBook documentation, a platform widely used by developers and organizations to publish guides and manuals. The threat involves unauthorized wallet draining when users interact with embedded scripts or malicious prompts disguised as legitimate content. Given the domain’s current status and the absence of detections on VirusTotal, there is a credible risk of financial theft for unsuspecting visitors engaging with this impersonation.

Technical indicators reveal this domain was registered via Cloudflare, Inc. on March 30, 2014, and resolves to IP address 104.18.40.47. It holds a valid SSL certificate issued by Google Trust Services, which may lend false legitimacy. Notably, VirusTotal currently shows 0 detections out of 95 scanners, indicating it has not yet been widely flagged despite clear malicious intent inferred from its naming pattern and context. The domain name metamzklvgan.gitbook.io mimics the legitimate gitbook.io by appending a suspicious prefix, a common tactic in brand impersonation attacks targeting crypto users.

If you have visited metamzklvgan.gitbook.io, disconnect your wallet immediately and revoke any unauthorized permissions through your wallet’s interface or tools like revoke.cash. Do not interact further with the site. Scan your system for malware using reputable antivirus software. Report the domain to your security team and consider blocking it via DNS or firewall rules. Always verify URLs manually by checking the domain spelling and using official sources before visiting any crypto-related platform.