kastxyz[.]gitbook[.]io

The domain kastxyz.gitbook.io is currently active and has been identified as a high‑risk brand‑impersonation site targeting the Solana ecosystem. The site presents itself as the “KAST Affiliate Program Wiki” according to the page title “Introduction to KAST | KAST Affiliate Program Wiki”, suggesting an attempt to lure Solana users into a cryptocurrency‑related scheme.

Infrastructure analysis shows the domain is served through Cloudflare’s network, using the authoritative name servers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. DNS resolution points to IP address 104.18.40.47, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE1 profile, providing HTTPS with HSTS enabled. HTTP requests receive a 307 temporary redirect, and the service supports HTTP/3.

Technology fingerprints reveal a GitBook‑based documentation platform hosted on Google Cloud, with additional observables such as Google Cloud Trace and standard Cloudflare edge features. The site is classified as a cryptocurrency scam, and its reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records a single positive detection out of 95 scanners. The domain appears on one external blocklist and is already flagged by PhishDestroy.

Given the combination of a high‑risk brand impersonation, low trust scores, and the use of reputable hosting services to mask malicious intent, defenders should prioritize mitigation. Network security controls ought to block traffic to 104.18.40.47 and to the host name kastxyz.gitbook.io. Endpoint protection should include the domain in URL filtering lists, and threat‑intel feeds should be updated to reflect its presence on blocklists. Continuous monitoring of DNS queries for the Cloudflare name servers may reveal additional abuse patterns.