matamsklogex[.]gitbook[.]io

This domain, matamsklogex.gitbook.io, is identified as an active credential theft operation targeting MetaMask wallet users. The page title, '𝗠𝗲𝘁å𝗺å𝘀𝗸 𝗟𝗼𝗴𝗶𝗻 - Us,' directly impersonates the legitimate MetaMask authentication interface, a tactic commonly employed to deceive users into disclosing sensitive login credentials and seed phrases. Analysis indicates this is not a generic phishing attempt but a specialized attack vector designed to compromise cryptocurrency wallets, potentially leading to unauthorized asset transfers and financial loss. No explicit drainer kit signatures were observed, but the focus on credential harvesting suggests integration with downstream cryptocurrency theft infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 172.64.147.209, a Cloudflare-hosted endpoint, and was originally registered on March 30, 2014, through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy to the malicious site. Detection metrics show that 8 out of 95 security vendors on VirusTotal have flagged this domain as malicious, with no current listings on Google Safe Browsing at the time of analysis. The domain remains registered and operational, indicating sustained malicious intent. Current status confirms the domain is still active and resolving, posing an ongoing risk to users. Response actions should include immediate blocklisting of the domain and IP address across security gateways, as well as user education to recognize impersonation tactics targeting cryptocurrency platforms. Despite the relatively low detection count on VirusTotal, the targeted nature of the threat and the potential for financial harm elevate the risk level to high. Users are advised to verify domain authenticity before entering credentials and to employ hardware-based or multi-factor authentication methods for cryptocurrency wallets to mitigate exposure.