exoodaiswalllogin[.]gitbook[.]io

PhishDestroy identifies exoodaiswalllogin.gitbook.io as an active credential phishing domain designed to steal login credentials under the guise of a legitimate service. This domain mimics the branding of a well-known cryptocurrency wallet interface, specifically targeting users who may enter their credentials under the false pretense of security validation. The threat actor leverages GitBook.io's subdomain hosting to create a deceptive facade, exploiting the platform's trustworthiness to bypass initial suspicion. Upon interaction, the page captures entered credentials, transmitting them to a remote server controlled by the attacker, which are then used to drain associated cryptocurrency wallets or hijack accounts. This domain was flagged with significant malicious indicators, including detection by 6 out of 95 VirusTotal security vendors, signaling elevated risk. It has been registered through Cloudflare, Inc., a common tactic to obscure true ownership and hosting details, and was created on March 30, 2014, predating its malicious use. Additionally, the domain is blocked by MetaMask and SEAL, and has appeared on 2 independent security blocklists, further validating its harmful nature. The SSL certificate issued by Google Trust Services adds a superficial layer of legitimacy, potentially tricking users into overtrusting the site. Users who have interacted with this domain, particularly by entering credentials or sensitive information, should immediately revoke access to any cryptocurrency wallets or accounts that share the same login details. Change passwords on all potentially affected accounts and enable two-factor authentication where available. Report the domain to your security provider or browser blocklists, and avoid accessing any services linked to this URL. Conduct a thorough audit of your digital footprint to ensure no further unauthorized access occurs.