kerakennlin[.]gitbook[.]io

This domain, kerakennlin.gitbook.io, is flagged for brand impersonation targeting Google. Analysis indicates the page masquerades as an official Google account verification portal, leveraging GitBook hosting to lend superficial legitimacy. The threat type is classified as brand impersonation, a tactic commonly employed to harvest credentials or distribute malicious payloads under the guise of trusted services. No drainer kit signatures were identified in preliminary scans, though further forensic examination of the hosted content is warranted. Infrastructure analysis reveals the domain was registered on March 30, 2014, through Cloudflare, Inc., and currently resolves to the IP address 104.18.41.89. Detection metrics show a VirusTotal score of 2/95, indicating limited but confirmed malicious classification by security vendors. The domain appears on one security blocklist, while Google Safe Browsing status remains unconfirmed. Technologies detected include GitBook, Google Cloud, Cloudflare, and analytics tools such as HubSpot and Google Tag Manager, suggesting an attempt to mimic legitimate corporate infrastructure. As of the latest assessment, kerakennlin.gitbook.io has been taken offline, likely in response to security vendor reports. However, residual risk persists due to the domain's historical registration and potential for reactivation. Organizations are advised to monitor for related indicators of compromise, including the IP 104.18.41.89 and SSL certificate issued by Google Trust Services. Network-level blocking of the domain and associated infrastructure is recommended as a precautionary measure. Continuous vigilance is required, as threat actors may pivot to alternative hosting or rebranding tactics.