crknlogcn[.]gitbook[.]io

This domain, crknlogcn.gitbook.io, has been identified as a credential harvesting phishing site targeting users through deceptive login portals. As of the latest verification, the domain is offline, though it previously exhibited active malicious behavior. No specific brand impersonation has been confirmed, but the infrastructure aligns with common phishing tactics designed to harvest sensitive authentication details. Analysis indicates the domain was flagged by 18 of 95 security vendors on a leading malware detection platform, signaling broad consensus on its malicious nature. Registered through a privacy-focused provider on March 30, 2014, the domain resolved to the IP address 198.18.0.189, hosted on a content delivery network operated by a large US-based infrastructure provider. The SSL certificate was issued by a trusted public certificate authority, which is frequently exploited by threat actors to lend legitimacy to phishing pages. The domain appeared on one security blocklist and was explicitly flagged for phishing by a major web safety service. Infrastructure analysis reveals the domain leveraged a widely used documentation hosting platform, which is often abused due to its free tier and ease of deployment. While currently offline, the domain’s historical activity and detection metrics warrant continued monitoring. Organizations are advised to block the domain at the DNS and proxy levels, revoke any cached SSL certificates associated with it, and conduct internal audits for potential exposure. Users who may have interacted with the domain should reset credentials immediately and enable multi-factor authentication on all critical accounts.