mstamasklogun[.]gitbook[.]io

PhishDestroy identifies mstamasklogun.gitbook.io as an active brand impersonation domain targeting MetaMask users. The page title reads 'MetaMask® Login | Blockchain Wallet,' and the site employs a drainer kit to trick visitors into connecting their wallets and disclosing private keys or seed phrases. The domain is registered through Cloudflare, Inc., and resolves to IP 104.18.40.47, indicating a potential abuse of legitimate hosting services.

This domain was flagged with 0 detections out of 95 on VirusTotal, remains unblocked by Google Safe Browsing, and shows zero presence on public blocklists. Registered on March 30, 2014, the domain leverages a Google Trust Services SSL certificate to enhance credibility, suggesting a deliberate effort to appear legitimate. These technical indicators, including the registrar, IP, creation date, GSB status, and blocklist count, collectively depict a low-detectability but high-risk impersonation campaign currently in circulation.

As of this report, the domain remains active and poses a significant threat to cryptocurrency users. Immediate response actions include user advisories to avoid visiting mstamasklogun.gitbook.io, reporting the domain to MetaMask’s fraud channels, and monitoring wallet connections for unauthorized transactions. Despite the low VirusTotal score, the campaign’s use of a reputable SSL certificate and credible hosting provider underscores the need for heightened user vigilance. Remaining risk is classified as under investigation but escalating, with potential for rapid propagation across social media and phishing forums.