maatrmssk-loggn[.]gitbook[.]io

The domain maatrmssk-loggn.gitbook.io is identified as a high-risk brand_impersonation threat targeting MetaMask, a cryptocurrency wallet service. As of the latest assessment, the domain has been taken offline, though prior activity indicates malicious intent to deceive users into disclosing sensitive credentials or financial information. Analysis of the infrastructure reveals the domain was registered through Cloudflare, Inc. on March 14, 2026, and resolved to the IP address 172.64.147.209, associated with AS13335 (Cloudflare, Inc.) in the United States. Security vendors flagged the domain on VirusTotal, with 18 out of 95 engines detecting malicious activity. The domain appears on three security blocklists and was actively blocked by PhishDestroy, MetaMask’s internal security systems, and the SEAL consortium. The SSL certificate is issued by Google Trust Services (WE1), and the page title, '𝗠𝗲𝘁å𝗺å𝘀𝗸 𝗟𝗼𝗴𝗶𝗻,' employs Unicode characters to mimic the legitimate MetaMask branding, a tactic commonly used to evade detection and increase perceived authenticity. Current status confirms the domain is offline, though residual risks may persist if cached or archived versions remain accessible. Organizations and users are advised to verify domain authenticity before interacting with any login portals, particularly those requesting cryptocurrency wallet credentials. Security teams should update blocklists to include this domain and monitor for similar impersonation attempts leveraging Unicode spoofing or Cloudflare-hosted infrastructure. If credentials were entered on this domain, immediate password resets and wallet security reviews are recommended.