brandtobook3[.]com

brandtobook3.com is currently active and was registered on September 24, 2025 through Porkbun LLC. The domain resolves to the Cloudflare edge address 162.159.140.166, which belongs to AS13335 and is located in the United States. HTTPS is provided by a Let's Encrypt certificate (R13), and the site redirects with an HTTP 301 response. Infrastructure analysis shows the presence of Ruby and Ruby on Rails frameworks, as well as third‑party libraries Rudderstack, jsDelivr, and the use of HTTP/3 under Cloudflare. The page title returned by the server is “Branding by Books”, which does not directly reference a known brand, but the threat classification in the intelligence indicates a brand‑impersonation campaign targeting the “across” brand and using a crypto‑scam lure.

The domain is listed on two security blocklists – PhishDestroy and ScamSniffer – and two of ninety‑five VirusTotal scanners have flagged it as malicious. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. Nameservers are hosted by Porkbun (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com), confirming the registrar’s involvement. Defenders should block or sinkhole traffic to brandtobook3.com at the DNS level, enforce TLS inspection to capture the 301 redirect, and monitor outbound connections to the Cloudflare IP range for any data exfiltration attempts.

Because the site is identified as a crypto‑scam that impersonates a brand, email and web gateway filters should be updated to flag any messages or links containing the domain. Continuous re‑scanning with VirusTotal and other multi‑engine scanners is advisable, as the current detection count is limited to two vendors. The lack of additional public content beyond the page title leaves the exact payload unknown, so threat‑intel teams should collect a full page capture if possible and share indicators of compromise with upstream security communities.