help-metmskwltext[.]gitbook[.]io

This domain, help-metmskwltext.gitbook.io, is flagged as an active high-risk phishing site targeting cryptocurrency wallet users. Analysis indicates the domain was registered on June 11, 2026, through Cloudflare, Inc., and currently resolves to IP address 104.18.40.47, hosted on Cloudflare’s infrastructure in Canada. The domain is blocked by three security providers, including MetaMask and SEAL, suggesting it impersonates MetaMask or related wallet services. Fourteen of ninety-one security vendors on VirusTotal have detected malicious activity associated with this domain, reinforcing its classification as a phishing threat. Infrastructure analysis reveals the use of Cloudflare nameservers (dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which is consistent with legitimate services but frequently exploited by threat actors to lend credibility. The domain returns an HTTP 403 status, indicating access is restricted or intentionally obscured, a common tactic to evade automated crawlers while remaining accessible to targeted victims. Technologies detected include Cloudflare and HTTP/3, further confirming reliance on Cloudflare’s network for hosting and protection. The exact content of the site remains unanalyzed, but the presence of 'metmskwltext' in the subdomain strongly suggests an attempt to deceive users into believing it is an official MetaMask support or wallet-related page. Defenders should treat this domain as an active threat, block it at the network level, and monitor for related indicators of compromise, including the associated IP address and SSL certificate. No evidence of takedown or mitigation has been observed as of July 12, 2026.