mtamasckvloglz[.]gitbook[.]io

The domain mtamasckvloglz.gitbook.io has been identified as a high-risk phishing site. This site was designed to impersonate a well-known digital wallet service, using deceptive tactics to harvest user credentials. The threat type is categorized as generic phishing, indicating a broad attempt to deceive users into providing sensitive information under the guise of a legitimate brand.

Technical analysis of the domain reveals several critical indicators of compromise. The domain is hosted on an IP address 104.18.40.47, which is registered under Cloudflare, Inc. It was originally created on March 30, 2014. VirusTotal reports that 19 out of 95 security vendors have flagged this domain as malicious. Additionally, the domain has been placed on three different security blocklists. The SSL certificate was issued by Google Trust Services, specifically the WE1 certificate, and the site was previously accessible under the page title 'Sign ✞ In | M𝐞tåMäsk® ☝ Login*'.

Currently, the domain status is offline, and it has been actively blocked by security entities such as PhishDestroy, the targeted brand, and SEAL. Although the domain is no longer active, the risk remains for similar phishing attempts utilizing different domains or subdomains. It is crucial for users to remain vigilant and verify the authenticity of websites requesting sensitive information. Continued monitoring by security teams and user awareness are essential to mitigate residual risks associated with this phishing campaign.