home-page-eigenlayer[.]gitbook[.]io

PhishDestroy analysts have identified the domain home-page-eigenlayer.gitbook.io engaging in brand impersonation of EigenLayer, actively deployed as a cryptocurrency drainer kit targeting users under the guise of a legitimate EigenLayer interface. This domain masquerades as EigenLayer to harvest wallet credentials and seed phrases, redirecting victims to malicious smart-contract drainer scripts that rapidly empty token balances. The domain operates over HTTPS with a Google Trust Services SSL certificate, lending it an air of legitimacy. Technical indicators confirm the site resolves to IP 172.64.147.209, is registered through Cloudflare, Inc., and was created on March 30, 2014. Despite zero detections on VirusTotal (1/95 engines as of latest scan), PhishDestroy flags it due to semantic mismatch with the legitimate EigenLayer brand and the presence of drainer infrastructure. The site remains absent from the Google Safe Browsing (GSB) blocklist, increasing its potential reach. As of today, the threat remains active with no official remediation recorded by hosting or registrar providers. PhishDestroy has escalated this report to Cloudflare Trust & Safety and Google Safe Browsing for prioritized review. Users are advised to verify all links—especially those shared in social media, Discord, or Telegram—using PhishDestroy’s real-time threat lookup tool before interacting. The remaining risk is classified as active with high potential impact to cryptocurrency holders. Immediate verification is the only effective defense against credential and asset loss.