metamsklogec[.]gitbook[.]io

This domain is flagged as a high-risk phishing threat specializing in cryptocurrency credential theft. Analysis indicates the infrastructure is designed to mimic legitimate MetaMask login interfaces, tricking users into submitting wallet credentials, recovery phrases, or private keys. The specific threat type is a credential harvesting attack targeting cryptocurrency wallet users, with potential for immediate financial loss upon credential submission. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain metamsklogec.gitbook.io is detected by 17 out of 95 security vendors on VirusTotal, appearing on three independent security blocklists. It resolves to IP address 104.18.40.47, geolocated to Cloudflare infrastructure in Canada. The domain was registered through GitBook on May 18, 2026, with an SSL certificate issued by Google Trust Services (WE1). Notably, the creation date is anomalous, suggesting either a typo-squatting attempt or an error in registration records. The domain is currently offline but was actively blocked by multiple security layers prior to takedown. Mitigation requires immediate action from both end-users and security teams. Users who interacted with this domain should assume credential compromise and perform the following steps: revoke all active sessions, transfer assets to a new wallet with a fresh seed phrase, and monitor transaction history for unauthorized activity. Security teams should add the domain and associated IP (104.18.40.47) to blocklists, implement DNS sinkholing, and deploy endpoint detection rules for related phishing patterns. Organizations handling cryptocurrency transactions should enforce multi-factor authentication and educate users on identifying homoglyph attacks in domain names, particularly those using non-standard Unicode characters to mimic legitimate services.