matamsklogzn.gitbook.io: Metamask credential-harvesting phishing

This domain, matamsklogzn.gitbook.io, is flagged as a high-risk brand impersonation resource targeting Metamask wallet users. Analysis indicates the site employs a credential-harvesting phishing kit, using Unicode characters in the page title (Log# In | #M𝐞tåMäsk® - Wallet) to evade basic text-based detection while mimicking the legitimate Metamask login interface. No direct association with cryptocurrency drainer scripts has been confirmed, though the infrastructure supports rapid deployment of such payloads if required. Infrastructure analysis reveals the domain resolves to IP 172.64.147.209 and was registered through Cloudflare, Inc. The creation date is listed as May 09, 2026, suggesting potential domain spoofing or incorrect registry data. VirusTotal reports 18 out of 95 security vendors flagging this domain as malicious, while it appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services, and technologies detected include GitBook, Google Cloud, Cloudflare, and HTTP/3, indicating a multi-layered hosting environment designed to complicate takedown efforts. As of the latest assessment, matamsklogzn.gitbook.io has been taken offline, likely following reports from MetaMask, PhishDestroy, and SEAL. However, the underlying infrastructure remains active, and similar domains may resurface using the same hosting providers and evasion techniques. Users are advised to verify domain authenticity via official channels before entering credentials, enable multi-factor authentication where available, and monitor for unauthorized transactions. Security teams should block the IP 172.64.147.209 and monitor for related domains using the same Unicode obfuscation patterns in page titles.