exhoduswibvbnwalet[.]gitbook[.]io

The domain exhoduswibvbnwalet.gitbook.io is currently listed as an active generic phishing infrastructure. Registration data shows the domain was created on March 30, 2014 and is serviced by Cloudflare, Inc., with authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. DNS resolution points to the IP address 172.64.147.209, which is hosted behind Cloudflare’s edge network. The domain appears on three external security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple downstream protection platforms have observed malicious activity tied to this name. VirusTotal analysis reports that six of ninety‑one scanned security vendors flagged the domain, providing independent confirmation of its malicious reputation.

Evidence beyond the listed indicators is not yet available; no Safe Browsing verdict, Open Threat Exchange (OTX) entry, SSL certificate details, HTTP response codes, or page title have been disclosed in the shared intelligence. Consequently, the exact content served by the site remains unverified, and the specific phishing lure or target audience cannot be detailed at this time.

Defenders should prioritize immediate containment actions. Network‑level controls ought to block DNS resolution to exhoduswibvbnwalet.gitbook.io and traffic to its resolved IP 172.64.147.209. Endpoint security solutions should incorporate the six vendor detections from VirusTotal into their detection rules. Because the domain is hosted on Cloudflare, organizations may consider filing an abuse report with Cloudflare to accelerate takedown. Continuous monitoring of the associated IP range and periodic re‑scanning of the domain for updated threat intelligence are recommended to detect any evolution of the campaign.