aauth---g-sso-crypto--s-ap[.]gitbook[.]io

This domain is flagged for elevated risk due to brand_impersonation, specifically targeting Crypto.com users through a fraudulent login portal. The page title, 'Crypto.com® Login issues® | | Helping Center Navigating,' mimics legitimate customer support pages to deceive victims into entering credentials or sensitive information. Analysis indicates the domain was registered on March 30, 2014, through Cloudflare, Inc., and currently resolves to the IP address 104.18.40.47, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal reports 17 out of 95 security vendors have flagged this domain as malicious. The domain appears on one security blocklist, and its SSL certificate is classified as WE1. Infrastructure analysis reveals the domain was taken offline, but historical activity suggests prior abuse. Mitigation steps for this brand_impersonation threat include blocking the domain and its associated IP (104.18.40.47) at the network perimeter. Organizations should monitor for credential harvesting attempts and educate users on recognizing fraudulent login pages, particularly those mimicking customer support portals. Security teams should review logs for connections to this domain or IP and investigate any potential data exposure. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts.