okzoz[.]com

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the MetaMask cryptocurrency wallet service. Visitors to okzoz.com are presented with fraudulent interfaces mimicking legitimate MetaMask login or recovery pages, with the intent to harvest sensitive credentials such as wallet seed phrases, private keys, or account passwords. The site may also distribute malicious browser extensions or scripts that compromise user devices or intercept cryptocurrency transactions. Given the irreversible nature of blockchain transactions, exposure to such threats can result in immediate and permanent financial loss. Analysis indicates that okzoz.com was registered on May 9, 2023, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 43.255.31.98, hosted on AS133199 (SonderCloud Limited) in Hong Kong. As of the latest scan, 15 out of 95 security vendors on VirusTotal have flagged this domain as malicious, and it appears on three independent security blocklists. The SSL certificate, issued by Let's Encrypt (R12), provides basic encryption but does not validate the legitimacy of the site. Infrastructure analysis reveals no legitimate association with MetaMask or its parent entities, confirming the domain's fraudulent intent. Users who have visited okzoz.com or entered any credentials on the site should assume their information has been compromised. Immediately disconnect the device from the network and perform a full antivirus scan using updated security tools. Reset all passwords and seed phrases associated with MetaMask or other cryptocurrency wallets, and transfer any remaining assets to a new, secure wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams and consider filing a report with local cybercrime authorities. Do not re-use compromised credentials on any other platforms, as attackers may attempt to exploit them across multiple services.