cybermati[.]co[.]uk

This domain, cybermati.co.uk, is a confirmed brand impersonation threat targeting LinkedIn users. Analysis indicates the site was designed to mimic LinkedIn's login interface or professional networking pages, likely to harvest corporate credentials, personal data, or distribute malware under the guise of legitimate business communication. The page title 'MATI | Protection in Sight' suggests an attempt to appear as a security or verification service, a common tactic to lower user suspicion during credential collection attempts. Technical evidence confirms the malicious nature of this domain. VirusTotal reports 19 out of 95 security vendors flagging cybermati.co.uk as malicious, with Google Safe Browsing specifically classifying it as a phishing site. The domain was registered on December 26, 2024, through Ionos SE, a registrar frequently abused for short-lived phishing campaigns. Infrastructure analysis reveals the domain resolves to IPv6 address 2001:8d8:100f:f000::200, hosted on AS8560 (IONOS SE) in Germany. It appears on two security blocklists, including PhishDestroy and PhishingDB, and uses a Sectigo Limited DV SSL certificate (Sectigo Public Server Authentication CA DV R36) to create a false sense of legitimacy. Users who visited cybermati.co.uk should take immediate action to mitigate potential compromise. If credentials were entered, reset passwords for LinkedIn and any accounts sharing the same credentials, prioritizing email and financial services. Enable multi-factor authentication where available. Scan the device used to access the site for malware, focusing on browser-based keyloggers or credential stealers. Monitor accounts for unauthorized activity and report the incident to organizational security teams if accessed from a work device. Given the domain's recent creation and rapid takedown, remain vigilant for follow-up phishing attempts via email or other communication channels.