metamaskuklogin[.]gitbook[.]io

PhishDestroy identifies a deceptive domain actively impersonating MetaMask, one of the most widely used cryptocurrency wallet platforms. The fraudulent site hosted at metamaskuklogin.gitbook.io is designed to trick users into entering their MetaMask login credentials under the false pretense of a secure login portal.

This domain was flagged by PhishDestroy’s automated monitoring systems due to multiple red flags: it uses the GitBook.io subdomain platform, was registered through Cloudflare, Inc., and went live on March 30, 2014. Although VirusTotal currently shows 19 out of 95 security engines detecting malicious content, this reflects only a temporary snapshot, not a guarantee of safety. The domain resolves to IP address 104.18.40.47 and uses a Google Trust Services SSL certificate — both common tactics used by threat actors to appear legitimate.

If you visited metamaskuklogin.gitbook.io or entered any information on the site: immediately reset your MetaMask password, enable two-factor authentication if not already active, and review your wallet transaction history for suspicious activity. Never reuse wallet passwords elsewhere. Consider using a hardware wallet for enhanced security and avoid accessing crypto platforms through unofficial links. Always verify URLs via official MetaMask channels. Stay vigilant against ongoing impersonation campaigns targeting crypto users.