matteosafe[.]com

This domain, matteosafe.com, is identified as a fraudulent phishing site designed to mimic account suspension notifications. Analysis indicates the threat type is a fake login portal, likely intended to harvest user credentials by displaying a deceptive 'Account Suspended' page. No specific brand impersonation or crypto drainer kit signatures were detected in the initial assessment, though the page structure aligns with common credential theft tactics. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 198.23.190.194 and is flagged by 3 out of 95 security vendors on VirusTotal. It was registered through Atak Domain Bilgi Teknolojileri A.S. on July 22, 2025, and appears on one security blocklist. The domain is not currently listed on Google Safe Browsing (GSB), though it has been blocked by at least one threat intelligence feed. The page title, 'Account Suspended,' is a known lure used in phishing campaigns to create urgency and prompt victims into entering sensitive information. As of the latest assessment, the domain has been taken down, and no active malicious content is being served. However, residual risk remains due to the domain's recent registration and prior malicious activity. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for related indicators, including the IP address and registrar details, to prevent potential follow-up attacks from similar infrastructure.