app-io--trezr[.]gitbook[.]io

PhishDestroy identifies the domain app-io--trezr.gitbook.io as an active credential-phishing platform targeting unsuspecting users under the guise of a document-sharing service. This domain is currently engaged in a live campaign designed to trick victims into surrendering sensitive login credentials or personal data. The fraudulent activity mirrors legitimate GitBook documentation portals, leveraging social engineering tactics to exploit user trust. Immediate avoidance and reporting are strongly advised to prevent credential compromise and downstream account takeovers.

This domain was flagged by 11 of 95 VirusTotal security vendors and resolves to IP 172.64.147.209 via Cloudflare, Inc. The domain was created on March 30, 2014, and operates under a Google Trust Services SSL certificate. These technical indicators, combined with the elevated detection rate and Cloudflare fronting, suggest an attempt to blend in with legitimate web infrastructure while hosting malicious content. The presence of 11 detections across multiple vendor engines underscores the elevated risk this domain poses to end-users.

The current status of app-io--trezr.gitbook.io remains active and dangerous. Users who have accessed this domain or entered credentials should immediately change passwords, enable multi-factor authentication, scan devices for malware, and report the incident to relevant security teams. Organizations are advised to block the domain at network and DNS levels and monitor internal logs for anomalous access. PhishDestroy continues to track this campaign and recommends heightened vigilance when navigating documentation-style portals or cloud services.