mtamsklxogn[.]gitbook[.]io

PhishDestroy analysts have rated mtamsklxogn.gitbook.io as a high-risk threat, specifically targeting users through a credential harvesting scheme disguised as a legitimate GitBook page. This domain was registered via GitBook itself on May 18, 2026, and resolves to IP address 104.18.40.47. VirusTotal data shows 11 out of 95 security vendors flag this domain as malicious, and it appears on three security blocklists, indicating widespread recognition of its dangerous nature. The SSL certificate was issued by Google Trust Services (WE1), lending an initial veneer of legitimacy to the phishing operation. Although the domain is currently offline, the sophistication of its setup suggests that similar attacks may resurface under different subdomains.

The risk is elevated because the phishing site mimicked GitBook's trusted interface to steal sensitive credentials such as usernames and passwords. Users who may have visited the site before it was taken down are strongly advised to change their passwords for any accounts used on GitBook or related services, enable two-factor authentication, and monitor for unusual account activity. Organizations should add this domain and its IP to their blocklists and educate users about verifying URL authenticity before entering credentials. PhishDestroy recommends scanning any devices that may have accessed the phishing page for malware or data theft indicators.