auth-iotrzor-cdn[.]gitbook[.]io

The domain auth-iotrzor-cdn.gitbook.io is currently flagged as a high‑risk phishing infrastructure. According to the available intelligence, the domain resolves to the IP address 104.18.40.47, which belongs to Cloudflare’s network, and its registration is listed under Cloudflare, Inc. The domain was created on March 30, 2014 and continues to use the Cloudflare nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. VirusTotal records show that 7 of 91 scanned security vendors have raised alerts on this host, indicating that a subset of detection engines consider it malicious.

It appears on one external security blocklist and is explicitly listed as blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing platform has observed abusive activity originating from this FQDN. The overall status is marked as active, meaning the domain is still reachable and capable of serving malicious content. No public information about the page title, SSL certificate details, HTTP response codes, or specific phishing campaign attributes has been released, leaving the exact content and targeted brand undefined.

Consequently, defenders should treat the domain as suspicious until further content analysis is performed. Recommended mitigations include adding the domain to network and endpoint blocklists, monitoring DNS queries for repeated resolution to 104.18.40.47, and applying sink‑hole or redirect policies where feasible. Continuous re‑evaluation is advised, as additional telemetry from security vendors or blocklist updates may refine the risk posture.