iotrzorhardirewallet[.]gitbook[.]io

iotrzorhardirewallet.gitbook.io is currently active and has been identified as a crypto‑drainer infrastructure. The domain is registered through the GitBook platform, which provides free sub‑domain hosting for documentation sites. DNS resolution points to the address 104.18.40.47, indicating that the site is served from a shared hosting environment typical of GitBook deployments.

The domain appears on two public security blocklists and is specifically listed by PhishDestroy and OpenPhish as a malicious entry. VirusTotal analysis shows that 14 of 91 scanning engines have flagged the domain as malicious, reinforcing the blocklist observations. No additional telemetry such as SSL certificate details, HTTP response codes, or page titles is available in the current intelligence set, so the exact content and attack vector employed by the site remain unconfirmed.

Nevertheless, the convergence of blocklist presence, multi‑engine detections, and the association with a crypto‑drainer campaign suggests a high likelihood that the domain is used to lure victims into transferring cryptocurrency to attacker‑controlled wallets. Defensive actions should include immediate blocking of the domain at network perimeter and endpoint filters, updating intrusion‑detection signatures to include the observed IP address, and enforcing strict DNS monitoring for queries to the GitBook sub‑domain space. Security teams are advised to continue periodic re‑scanning of the domain, collect HTTP response data when possible, and share any new indicators of compromise with relevant threat‑sharing platforms to improve community awareness.