mnietamask-wcllet[.]gitbook[.]io

This domain, mnietamask-wcllet.gitbook.io, is actively flagged as a high-risk phishing site targeting cryptocurrency wallet credentials, specifically mimicking MetaMask infrastructure. Analysis indicates the domain is hosted on GitBook’s documentation platform and resolves to IP 172.64.147.209, a Cloudflare-operated address in California. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare’s standard deployment, though this does not mitigate the malicious intent of the content. A 403 HTTP status suggests either restricted access or backend protections, yet the domain remains operational and is blocked by at least one security vendor. Infrastructure reveals Cloudflare’s network presence, including HTTP/3 protocol usage, which may complicate traditional traffic inspection. The domain appears on a single security blocklist, and 13 of 91 vendors on a multi-engine scan platform have flagged it as malicious. While the exact phishing mechanics—such as credential harvesting forms or wallet drainer scripts—are not yet confirmed due to restricted access, the naming convention (mnietamask-wcllet) strongly implies an attempt to deceive users into disclosing MetaMask wallet credentials. Defenders should treat this domain as an active threat. Network-level blocking of 172.64.147.209 and associated GitBook subdomains is recommended. Further investigation into GitBook’s hosting policies may be warranted to identify abuse patterns, though no evidence currently suggests systemic platform compromise. The domain’s continued activity despite partial vendor detection underscores the need for layered defenses, including endpoint protection and user education on cryptocurrency phishing risks.