csoensbaacomlogin[.]gitbook[.]io

The domain csoensbaacomlogin.gitbook.io was registered on 21 Feb 2026 via Cloudflare, Inc. and is hosted behind Cloudflare’s edge network (AS13335) with the IP address 172.64.147.209 located in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that the content is currently inaccessible. SSL termination is performed by Google Trust Services under the WE1 certificate, confirming that TLS is active but does not imply legitimacy. VirusTotal analysis shows that 16 of 93 security vendors have marked the domain as malicious, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent.

The infrastructure uses Cloudflare’s HTTP/3 protocol and the authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. The observed scam type is credential phishing, although the specific target brand or credential collection page has not been disclosed. Uncertainty remains around the exact phishing payload, as the site content is offline and no payload samples have been harvested.

No additional intelligence such as Safe Browsing alerts, OTX identifiers, or malware kit attribution is available. Defenders should update perimeter filters to block both the domain name and its associated IP range, enforce DNS‑based deny‑list rules for the listed nameservers, and monitor for any look‑alike domains that reuse the “csoensbaacomlogin” pattern. Endpoint protection should be tuned to flag any attempt to resolve or connect to this host, especially given its low trust score and multi‑vendor detection. Continuous threat‑intel feeds should be consulted for any future re‑activation, and incident response teams should be prepared to investigate credential compromise reports that reference the gitbook.io subdomain space.