homepage-w-eigenlayer[.]gitbook[.]io

Analysis of homepage-w-eigenlayer.gitbook.io indicates that the domain is actively leveraged for phishing. The domain is registered through Cloudflare, Inc. and was created on 30 March 2014. Its authoritative name servers are dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, both belonging to Cloudflare's DNS infrastructure. DNS resolution points to the IP address 172.64.147.209, which is part of Cloudflare's edge network and does not reveal a distinct hosting provider beyond the CDN service. The domain appears on a single security blocklist and is specifically listed by PhishDestroy as a malicious entry.

VirusTotal scans show that two of ninety‑one security vendors flagged the domain, confirming that at least a minority of automated scanners have identified suspicious characteristics. No additional public intelligence such as Safe Browsing verdicts, OTX mentions, or SSL certificate details are available in the current dataset. The lack of further metadata means that the precise phishing campaign—targeted brand, lure content, or hosting geography—cannot be confirmed at this time. Although the registration date of 2014 predates many recent phishing campaigns, the reuse of long‑standing domains is a known tactic to exploit existing trust and lower detection latency. The use of Cloudflare’s CDN service provides anonymity for the operator, making attribution difficult and allowing rapid turnover of hosting resources.

The fact that only two security vendors raised alerts may reflect limited visibility rather than benign behavior, and the presence on PhishDestroy’s list underscores a credible threat perception. In the absence of publicly disclosed SSL/TLS parameters, defenders cannot rely on certificate pinning or reputation for transport security. Consequently, the recommendation is to block the domain at perimeter firewalls, proxy filters, and endpoint protection suites, and to incorporate the IP address 172.64.147.209 into network‑level deny lists.