help-mettmsk[.]gitbook[.]io

help-mettmsk.gitbook.io is an active site that mimics the official MetaMask documentation. The page title “Powered by GitBook Metamask® Chrome® Extension | Getting started with MetaMask” is displayed, indicating a deliberate brand impersonation aimed at credential harvesting. The domain was registered on May 12, 2026 through the GitBook platform and immediately resolved to the IP address 172.64.147.209, which is owned by Cloudflare, Inc. and geo‑located in Canada. The threat is classified as high risk and remains active as of July 12, 2026.

Network characteristics show the site is protected by a Google Trust Services / WE1 SSL certificate, and HTTP requests are responded to with a 307 temporary redirect, a pattern commonly used to forward victims to a credential‑stealing page while preserving the original URL. The domain resolves to the same Cloudflare IP used by other known phishing infrastructure, reinforcing the likelihood of shared hosting.

Reputation data confirms malicious intent: the domain appears on three security blocklists, receives a Gridinsoft trust score of 0 out of 100, and is flagged by six of ninety‑five VirusTotal scanners. It is also listed as blocked by PhishDestroy, MetaMask, and SEAL. The identified scam type is phishing_login, consistent with attempts to capture MetaMask user credentials.

Defenders should add help-mettmsk.gitbook.io to allow‑lists of blocked domains, monitor DNS queries for the associated Cloudflare IP, and enforce strict URL filtering for any GitBook subdomains that reference MetaMask. Users should be advised to verify URLs against the official MetaMask site and to avoid entering credentials on pages that redirect through unknown GitBook domains. Given the high risk rating, incident response teams should prioritize takedown requests and coordinate with the hosting provider. Continuous observation of the IP 172.64.147.209 for new hostnames is recommended.