oauth-trezrrstart[.]gitbook[.]io

The domain oauth-trezrrstart.gitbook.io is currently active and hosted on Cloudflare’s network, resolving to the address 104.18.40.47. Registration data shows the domain was created on 30 March 2014 through Cloudflare, Inc, and the authoritative name servers are dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. VirusTotal has recorded 13 detections out of 91 scanned security vendors, indicating a moderate level of consensus that the site is malicious. The intelligence classification tags the site as a generic_phishing operation, suggesting that it is being used to harvest credentials or other sensitive information. No additional content analysis is available, and the specific phishing campaign details remain unknown. Defenders should consider blocking the domain at perimeter and DNS layers, adding it to threat‑intel feeds, and monitoring for any related command‑and‑control traffic that may reference the same IP address or Cloudflare name servers. Ongoing observation is recommended to capture any future changes in the site’s content or hosting configuration.