metauslkocxzgimens[.]gitbook[.]io

Analysis of metauslkocxzgimens.gitbook.io indicates that the domain is currently active and associated with a generic phishing campaign. The domain is hosted on Cloudflare’s infrastructure, as evidenced by the registrar entry for Cloudflare, Inc., and the authoritative name servers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. DNS resolution points to the IP address 172.64.147.209, which is part of Cloudflare’s address pool and does not, by itself, reveal the ultimate backend server. The domain was created on March 30, 2014, a relatively long registration period that may be leveraged to lend credibility to malicious emails or messages.

Threat intelligence feeds have listed the domain on two security blocklists, and it is actively blocked by PhishDestroy and OpenPhish, demonstrating that multiple independent anti‑phishing services have identified it as malicious. VirusTotal scans show that 18 of 91 security vendors have flagged the domain, providing further corroboration of its malicious nature. No public page title or brand target is available in the supplied data, so the specific victim lure remains unspecified. Defenders should block outbound connections to 172.64.147.209 and add metauslkocxzgimens.gitbook.io to URL filtering policies.

Monitoring for DNS queries to the Cloudflare name servers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com may aid in early detection of further infrastructure reuse. Incident response teams should treat any communications referencing this domain as potentially compromised and advise users to avoid clicking links or entering credentials associated with it. Continuous re‑evaluation of blocklist status and VirusTotal detections is recommended to capture any evolution of the campaign.