home--sso--eigeenlyer[.]gitbook[.]io

Analysis of the domain home--sso--eigeenlyer.gitbook.io, observed on July 12 2026, indicates active credential phishing infrastructure. The domain was registered on April 10 2026 via Cloudflare, Inc., and uses Cloudflare nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. DNS resolution points to IP 104.18.40.47, which belongs to Cloudflare, Inc. in Canada. The site presents an HTTP 403 response, and its SSL certificate is issued by Google Trust Services under the WE1 identifier, suggesting a valid TLS termination but not confirming legitimacy of the hosted content. Reputation metrics show a Gridinsoft trust score of 0/100 and the domain appears on three independent security blocklists. VirusTotal scans recorded three positive detections out of ninety‑four scanners, reinforcing the malicious classification. The domain is currently listed as blocked by PhishDestroy, MetaMask, and SEAL, and its threat type is identified as generic credential phishing with a high risk rating. While the available data confirms malicious intent, the specific payload, targeted brand, or phishing page content has not been publicly disclosed. Defenders should block DNS resolution to 104.18.40.47, add the domain to URL filtering policies, and monitor for related activity in network logs. Ongoing observation is recommended to capture any future changes in hosting or content.