cunbseprolggn[.]gitbook[.]io

PhishDestroy identifies this active credential-stealing campaign hosted at cunbseprolggn.gitbook.io. The page mimics a legitimate GitBook login portal to harvest usernames and passwords, then passes stolen credentials to attacker-controlled servers. Visitors risk account takeovers on linked services like MetaMask, cryptocurrency wallets, and enterprise accounts if the same password is reused. The threat is elevated because the attackers are using a long-lived domain (registered March 30, 2014) that still resolves to a Cloudflare IP (172.64.147.209) and maintains a Google Trust Services SSL certificate, increasing the appearance of legitimacy. This domain was flagged by PhishDestroy on seed 63c856 after it triggered 7 of 95 VirusTotal detections and appeared on two public blocklists curated by SEAL and MetaMask. The registrar is Cloudflare, Inc., which complicates takedowns due to Cloudflare’s abuse-resistant infrastructure. Despite its age, the site remains active and is actively promoted through malvertising and phishing emails that spoof known brands. The SSL certificate issued by Google Trust Services adds a veneer of trust, tricking users into entering sensitive data on a page that appears secure. If you visited cunbseprolggn.gitbook.io and entered any credentials, immediately change passwords on all linked accounts, enable multi-factor authentication, and revoke any API keys or tokens exposed during the session. Scan devices for malware using a reputable antivirus tool and review financial accounts for unauthorized transactions. Consider using a password manager to prevent reuse across sites. Report the incident to your organization’s security team or to PhishDestroy via the seed 63c856 for further analysis and IOC sharing.