matrmssk-walllote[.]gitbook[.]io

Analysis of the domain matrmssk-walllote.gitbook.io indicates active phishing infrastructure hosted on GitBook's platform, with Cloudflare providing front-end services. The domain resolves to IP address 172.64.147.209, part of Cloudflare's network, and employs HTTP/3 and a Google Trust Services SSL certificate. Registration details show the domain was created on March 30, 2014, though this long-standing registration does not preclude malicious repurposing. Detection metrics reveal that 13 of 95 security vendors on VirusTotal have flagged the domain, while two security blocklists—PhishDestroy and PhishingDB—currently list it as malicious. The domain's trust score is rated at 0/100 by Gridinsoft, further supporting its classification as high-risk. Infrastructure analysis reveals the use of Cloudflare as both registrar and CDN provider, a configuration that can obscure origin servers and complicate takedown efforts. The presence of GitBook as the hosting platform suggests the phishing content may be delivered via static documentation pages, a method increasingly observed in credential-harvesting campaigns. While the specific brand or service being impersonated remains unconfirmed due to lack of page content analysis, the domain's naming convention—containing 'walllote'—may indicate a focus on cryptocurrency or digital wallet deception. Defenders should prioritize blocking access to this domain at the network level, particularly in environments where cryptocurrency-related services are in use. Monitoring for related subdomains or similarly structured GitBook-hosted pages is recommended, as this pattern has been observed in coordinated phishing operations. Given the domain's continued activity and detection by multiple security sources, immediate mitigation is advised.