metsmsklgoini[.]gitbook[.]io

This domain is flagged for elevated-risk brand impersonation, specifically targeting MetaMask, a widely used cryptocurrency wallet platform. The threat type involves credential harvesting and potential financial fraud, as the page mimics the legitimate MetaMask login interface to deceive users into submitting sensitive wallet credentials or recovery phrases.

Infrastructure analysis reveals the domain metsmsklgoini.gitbook.io was registered through Cloudflare, Inc. on March 30, 2014, though the malicious activity appears to be a more recent deployment. It resolves to the IP address 104.18.40.47, hosted under AS13335 Cloudflare, Inc. in the United States. Security vendor detections on VirusTotal indicate 17 out of 95 engines flagged the domain as malicious. The domain appears on at least one security blocklist and is currently offline. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains, which does not inherently reduce risk in this context.

Mitigation measures for this threat type include immediate blocking of the domain and associated IP address within network security controls. End users should be educated to verify domain authenticity before entering credentials, particularly for cryptocurrency-related services. Organizations should monitor for similar impersonation patterns, such as domains containing partial brand names or hosted on third-party platforms like GitBook. Incident responders should treat any interaction with this domain as a potential compromise and initiate credential rotation for affected accounts.