aauth--ww--sso-crypto[.]gitbook[.]io

This advisory analyzes aauth--ww--sso-crypto.gitbook.io, an active crypto drainer posing as an SSO authentication portal. The domain leverages GitBook’s legitimate infrastructure to host fraudulent login forms that siphon cryptocurrency wallet credentials and private keys. Threat actors behind this campaign target users expecting SSO workflows, redirecting them to malicious drainer scripts under the guise of “crypto wallet authentication.” Historical data suggests this infrastructure has been operational since at least 2014, indicating long-term abuse potential.

PhishDestroy’s forensic review reveals exact technical indicators: the domain is flagged by 15 of 95 VirusTotal security vendors, resides under Cloudflare’s registrar, and resolves to IP 172.64.147.209. Registered on March 30, 2014, it benefits from a Google Trust Services SSL certificate, lending false legitimacy. The domain appears on a single OpenPhish blocklist and remains undetected by Google Safe Browsing as of current scans. These attributes underscore its evasive design, blending with benign GitBook subdomains while hosting malicious payloads.

Current status is active and elevated, with no known takedown by Cloudflare. Immediate response includes DNS-level blocking via OpenPhish feeds and local firewall rules targeting 172.64.147.209. Remaining risk persists due to Cloudflare’s widespread CDN usage and GitBook’s legitimate domain reputation, allowing continued low-detection phishing campaigns. Users are strongly advised to verify URLs via PhishDestroy before entering credentials or wallet access prompts.