metcsenlogih[.]gitbook[.]io

Analysis indicates that the sub‑domain metcsenlogih.gitbook.io is being used for a brand‑impersonation operation targeting MetaMask users. The site presents the page title “MetaMask Wallet | Download Blockchain Wallet App”, explicitly referencing the MetaMask brand, and the threat type is recorded as a crypto‑related scam. The domain is hosted on Cloudflare infrastructure, resolving to IP 172.64.147.209, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. DNS resolution is serviced by the Cloudflare authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, and the domain registration was performed through Cloudflare on March 30 2014. The TLS certificate is issued by Google Trust Services and includes the WE1 root, confirming that HTTPS is correctly configured, but the certificate alone does not attest to the legitimacy of the content.

HTTP requests receive a 307 temporary redirect response, a pattern often employed by malicious actors to steer browsers toward payloads or malicious download pages. The site is currently listed on the PhishDestroy blocklist and appears on one additional security blocklist, reflecting active detection by threat‑intelligence feeds. VirusTotal scans have flagged the domain in 16 of 95 security engines, indicating a moderate level of consensus among antivirus and URL‑reputation products that the domain is malicious. In contrast, the Gridinsoft trust score is 0 out of 100, confirming a very low confidence rating. The available evidence confirms that the domain is actively impersonating MetaMask and is associated with a crypto‑scam campaign, but no direct samples of payloads, phishing forms, or malicious binaries have been publicly disclosed.

Consequently, the exact malicious behavior (e.g., credential harvesting versus malicious wallet download) remains uncertain pending further investigative access to the site’s content.