metmsklguin[.]gitbook[.]io

This domain, metmsklguin.gitbook.io, is flagged as a brand impersonation threat designed to deceive users of MetaMask, a widely used cryptocurrency wallet. The site presents itself as a legitimate MetaMask login portal, using the page title 'MetaMask Lógin Community Platform | us' to trick visitors into entering sensitive credentials. Such impersonation attacks often lead to unauthorized access to digital wallets, resulting in financial loss or theft of cryptocurrency assets. The inclusion of a non-standard character ('ó' in 'Lógin') may further evade detection by users skimming the page title, increasing the likelihood of successful deception.

Analysis indicates this domain was created on March 30, 2014, though its malicious use appears recent. It is hosted on infrastructure managed by Cloudflare, Inc., resolving to the IP address 172.64.147.209, which is geolocated in the United States under AS13335. The domain is registered through Cloudflare and uses an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy. Security vendors on VirusTotal have flagged this domain, with 17 out of 95 engines detecting it as malicious. Additionally, the domain appears on one security blocklist, further corroborating its classification as a threat.

If you visited metmsklguin.gitbook.io or entered any credentials on the site, immediate action is required. First, revoke access to any MetaMask or cryptocurrency-related accounts linked to the site. Reset passwords and enable multi-factor authentication on all associated platforms. Monitor wallet transactions for unauthorized activity and consider transferring assets to a new wallet if suspicious activity is detected. Report the incident to the legitimate platform (MetaMask) to aid in broader threat mitigation efforts. Users should also scan their devices for malware, as credential theft sites may deploy additional payloads to maintain persistence or exfiltrate data.