blockcheen-wallet[.]gitbook[.]io

blockcheen-wallet.gitbook.io is an active brand‑impersonation site targeting Ethereum users. The domain was registered on 24 February 2026 and resolves to 172.64.147.209, an address owned by AS13335 Cloudflare, Inc. in the United States. DNS is served by Cloudflare name servers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, and the site is front‑ended by GitBook hosted on Google Cloud with HSTS, HTTP/3 and Google Cloud Trace enabled. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration. Threat intelligence shows the page title “Blockchain Wallet”, matching the declared scam type of cryptocurrency theft. The domain appears on one security blocklist and is currently blocked by PhishDestroy. VirusTotal scans report 15 of 93 security vendors flagging the domain, contributing to a low trust score of 0/100 from an independent reputation engine. The site returns an HTTP 307 redirect, suggesting possible redirection to a credential‑collection endpoint, though the final landing page has not been analysed. Defenders should add the domain and its IP to deny‑list rules, monitor for traffic to the Cloudflare‑hosted address, and treat any credential submissions referencing Ethereum wallets as malicious. Continuous observation is recommended to detect potential changes in hosting or additional phishing infrastructure.