matamsklgzn[.]gitbook[.]io

PhishDestroy identifies matamsklgzn.gitbook.io as a live Facebook credential phishing domain. This site masquerades as a legitimate GitBook-hosted page to harvest Facebook login details. No known drainer kit is associated with this domain at this time, but the threat type remains elevated due to active credential theft behavior.

This domain resolves to IP address 172.64.147.209 and was registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may lend false credibility. According to VirusTotal, 6 out of 95 security vendors flagged this domain as malicious. The domain was created on March 30, 2014, suggesting a long-standing presence that may have been recently compromised or repurposed for phishing. Google Safe Browsing (GSB) has not yet labeled this domain, but the low VT detection ratio indicates it may be evading some filters.

As of the latest assessment, matamsklgzn.gitbook.io remains active and continues to pose a threat. The domain’s use of Cloudflare and Google TLS may delay takedowns by obscuring hosting details. Users are advised not to interact with this domain, and security teams should block both the domain and IP address at the network perimeter. Remaining risk is elevated due to the active phishing campaign and potential for further compromise. Regular monitoring and domain reputation updates are recommended to prevent credential theft among users.