metamsakslogem-usa[.]gitbook[.]io

PhishDestroy identifies metamsakslogem-usa.gitbook.io as an active credential-phishing page masquerading as the legitimate Metamask wallet login interface.

This domain leverages homoglyph substitution (å for a) in both the domain label and page title to deceive users searching for ‘metamask login’. No drainer kit artifacts were detected on the observed page; the threat is a classic fake-login harvest, likely hosted on GitBook Pages under Cloudflare’s free tier. The page title displays Unicode characters (𝗠𝗲𝘁å𝗺å𝘀𝗸 𝗟𝗼𝗴𝗶𝗻 - Log In To Account (official)) to mimic official branding and increase trust.

Technical indicators are conclusive: VirusTotal detection ratio stands at exactly 7 of 95 security vendors (7.4%), the domain was created on March 30 2014, resolves to IP 172.64.147.209, uses a Google Trust Services SSL certificate, and is registered through Cloudflare Inc. Although the domain is aged, its current abuse stems from the recent impersonation campaign targeting Metamask users.

The campaign status is active as of the seed 61e0ee analysis window. Immediate blocklisting in enterprise DNS/SEIM systems is advised due to the 7/95 VT score and confirmed credential-harvesting intent. Users who accessed this page should revoke any entered wallet credentials, transfer assets to a new wallet, and scan devices for infostealers. Residual risk remains elevated while the page remains accessible on GitBook’s infrastructure; coordinated takedown requests to GitBook and Cloudflare have been initiated by PhishDestroy.