io-trezor-stcrt[.]gitbook[.]io

The domain io-trezor-stcrt.gitbook.io was registered on May 27, 2026 through the GitBook platform and is currently active. DNS resolution points to the IP address 104.18.40.47, which belongs to Cloudflare, Inc. and is geolocated in Canada. The site is served over HTTPS using a certificate issued by Google Trust Services under the WE1 authority, and HTTP traffic is observed to return a 307 redirect status, indicating a temporary redirect to another location. Traffic is delivered via Cloudflare’s HTTP/3 implementation, suggesting the use of modern acceleration and obfuscation techniques.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal analysis shows that 18 of 91 security vendors have flagged the domain, reinforcing the suspicion of malicious activity. The threat is classified as a crypto‑related scam that impersonates the Trezor brand, fitting a high‑risk profile for credential harvesting or financial fraud.

While the exact content of the hosted pages has not been examined, the combination of brand impersonation, a valid SSL certificate, and redirection behavior is consistent with typical credential‑stealing infrastructure. Defenders should block the domain at the DNS and proxy level, monitor outbound requests to the associated Cloudflare IP, and consider adding the domain to internal threat‑intel feeds. Continuous re‑evaluation is advised, as additional detections or changes in hosting could alter the threat landscape.