cionswexqt[.]gitbook[.]io

cionswexqt.gitbook.io is a subdomain of gitbook.io. PhishDestroy first observed the hostname on Feb 26, 2026. Stored content metadata identifies Genericcloudflare as the apparent target. The captured page title is “Suspected phishing site | Cloudflare”. Current evidence score: 95/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, Google Safe Browsing, Cloudflare Radar, and URLScan. VirusTotal recorded 15 detections among 95 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Fortinet, G-Data, Google Safebrowsing, Gridinsoft, Kaspersky, Lionic, Sophos, VIPRE on Jul 18, 2026 at 18:45 UTC. Google Safe Browsing flagged the domain: Social Engineering on Mar 2, 2026 at 20:51 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100; scan metadata assigned phishing as its category on Jul 29, 2026 at 03:19 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. PhishStats returned no feed match on Mar 2, 2026 at 20:09 UTC.

An access-restricted HTTP 403 response was recorded on Aug 7, 2026 at 01:01 UTC. Registration records for the registrable domain gitbook.io list Cloudflare, Inc. as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 104.18.40.47 on AS13335 (CLOUDFLARENET, US). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. DOM analysis on Apr 23, 2026 at 03:23 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Google Trust Services / WE1 as the certificate issuer with validity through Apr 21, 2026; checked Mar 15, 2026 at 08:06 UTC.

The content indicators and 4 positive source findings support the current Genericcloudflare impersonation and phishing classification. The target field identifies Genericcloudflare, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.