metmsklogun[.]gitbook[.]io

This domain is flagged as a high-risk phishing portal specifically designed to mimic the MetaMask cryptocurrency wallet login interface. Analysis indicates the site functions as a credential harvester, targeting users through brand impersonation and fraudulent login prompts. The page title, 'Met𝚊Mãsk $ Login* | @us,' employs Unicode spoofing to deceive victims into believing they are accessing the legitimate MetaMask authentication page, a common tactic in crypto drainer and wallet theft operations. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain resolves to IP address 172.64.147.209 and was registered on June 08, 2026, through GitBook, a platform frequently abused for hosting phishing content. Security vendors have flagged the domain in 17 out of 95 VirusTotal scans, and it appears on three independent security blocklists. The site was proactively blocked by wallet security systems and enterprise phishing detection feeds. The SSL certificate, issued by Google Trust Services, provides no inherent legitimacy, as phishing sites routinely use valid certificates to bypass initial security checks. Mitigation requires immediate action from both end users and security teams. Users who interacted with this domain should assume credential compromise and take steps to secure their crypto assets, including revoking active wallet sessions, transferring funds to a new wallet, and enabling hardware-based authentication. Security teams should add the domain, IP address 172.64.147.209, and associated indicators to blocklists and monitor for related infrastructure, such as GitBook-hosted subdomains or Unicode-similar domains. Given the high-risk nature of crypto wallet phishing, incident response should prioritize rapid containment and forensic analysis of any compromised endpoints.