myyethaerwallet[.]gitbook[.]io

This domain, myyethaerwallet.gitbook.io, is presently flagged as a high‑risk brand‑impersonation site targeting Ethereum users. The site resolves to 104.18.40.47, an address owned by Cloudflare, Inc. (AS13335) and is hosted behind Cloudflare’s network, presenting Cloudflare and HTTP/3 in its technology fingerprint. Registration data shows the domain was created on 30 Mar 2014 and was registered through Cloudflare, Inc., using the nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS endpoint despite the malicious intent.

The HTTP response is a 307 redirect, a pattern often used to forward victims to credential‑harvesting pages. The page title returned by the server reads “MyEtherWallet | Your Secure Gateway | World of Ethereum”, directly referencing the MyEtherWallet brand and the broader Ethereum ecosystem, confirming the impersonation claim. VirusTotal analysis shows that five of ninety‑three antivirus engines have flagged the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the suspicion. The domain appears on one external blocklist and has been blocked by the PhishDestroy feed, confirming that at least one security community has taken mitigative action.

Current intelligence indicates the infrastructure remains active; no evidence suggests takedown or remediation. Defenders should add the domain and its resolving IP to network‑level deny lists, enforce URL filtering policies for the GitBook subdomain, and monitor for any new sub‑domains or related Cloudflare‑hosted assets. Continuous re‑scanning with multi‑engine services is recommended to capture any changes in detection status. Organizations that manage Ethereum‑related credentials should educate users about the risk of unsolicited links to this domain and enforce multi‑factor authentication to limit potential compromise.