cuenbzseprlogonw[.]gitbook[.]io

This domain operates as a credential harvesting platform specifically designed to mimic cryptocurrency wallet interfaces. Victims are redirected through deceptive links to input private keys, recovery phrases, or login credentials, which are then transmitted to attacker-controlled infrastructure. The site employs social engineering tactics, including fake security alerts and urgent transaction prompts, to pressure users into immediate action without verification. Analysis indicates the domain was registered on May 2, 2026, through GitBook, a documentation hosting service often abused for phishing due to its legitimate appearance. Infrastructure review reveals it resolves to 104.18.40.47, a Cloudflare IP address in California, masking the true origin. VirusTotal detection metrics show 19 out of 95 security vendors flag the domain as malicious, with three separate security blocklists listing it for fraudulent activity. The SSL certificate, issued by Google Trust Services, further obscures its illegitimate purpose by providing an HTTPS connection. If this domain was visited, users should immediately revoke any entered credentials and assume compromise. Disconnect affected devices from networks and perform a full antivirus scan using updated definitions. Cryptocurrency wallet holders should transfer assets to a new wallet using a clean device, as recovery phrases or private keys may have been exposed. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant financial platforms and local cybersecurity authorities to assist in mitigation efforts.