auth-trzzzriostrt[.]gitbook[.]io

This domain, auth-trzzzriostrt.gitbook.io, is actively flagged as a phishing endpoint specifically designed to impersonate GitBook authentication portals. Analysis confirms the domain is currently operational with elevated risk status, serving content that mimics legitimate login workflows to harvest credentials. No direct brand impersonation of third-party services has been observed, though the infrastructure closely resembles GitBook's native authentication patterns, suggesting an attempt to exploit user trust in the platform's domain structure. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 14, 2026, through GitBook's hosting infrastructure and resolves to IP address 172.64.147.209, geolocated to a Cloudflare node in Canada. Security vendor detections are substantial, with 18 of 95 engines on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist, specifically PhishDestroy, and presents a Cloudflare interstitial warning page titled 'Suspected phishing site.' The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is commonly abused in phishing operations to lend false credibility. Current assessment indicates the phishing infrastructure remains active and unmitigated. The combination of recent registration, Cloudflare-hosted delivery, and targeted GitBook-themed deception warrants immediate caution. Organizations and users are advised to block the domain at the network perimeter and implement DNS-based filtering to prevent resolution. Security teams should treat any authentication prompts from this domain as fraudulent and initiate credential rotation for accounts that may have been exposed. Monitoring for similar patterns in gitbook.io subdomains is recommended, as this appears to be part of a broader campaign leveraging the platform's hosting services.