metamsakslogem-us[.]gitbook[.]io

Analysis of metamsakslogem-us.gitbook.io indicates a confirmed phishing infrastructure targeting cryptocurrency wallet credentials, specifically MetaMask users. The domain, registered on March 30, 2014, exhibits high-risk characteristics with active blocklist presence. It is flagged by 14 of 91 security vendors on VirusTotal and appears on two security blocklists: PhishDestroy and OpenPhish. The domain remains operational as of July 30, 2026, resolving to IP address 172.64.147.209, hosted on Cloudflare nameservers (dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com).

The registrar is Cloudflare, Inc., a common choice for both legitimate services and threat actors due to its privacy and proxy features. Infrastructure analysis reveals the domain leverages Cloudflare's network, which may obscure direct hosting details and complicate takedown efforts. The consistent blocklist presence and vendor detections provide concrete evidence of malicious intent, though the exact phishing kit or payload remains unconfirmed. Defenders should treat this domain as a high-risk credential harvesting site, particularly for users of MetaMask or similar cryptocurrency wallets.

Network-level blocking is recommended, along with monitoring for related subdomains or IP associations. While the domain's age (over 12 years) is unusual for phishing sites, this does not diminish its current threat status, as dormant domains are frequently repurposed for malicious campaigns. No additional brand impersonation details or page content analysis is available at this time.