kucixonlogen[.]gitbook[.]io

PhishDestroy identifies kucixonlogen.gitbook.io as an active credential theft phishing domain operating at an elevated risk level. The domain is currently hosting a campaign designed to harvest user credentials under false pretenses, leveraging GitBook’s legitimate hosting infrastructure to appear trustworthy. This tactic increases the likelihood of successful deception among less cautious users. This domain was flagged by 20 out of 95 participating VirusTotal security vendors, indicating moderate detection but not universal protection. It resolves to IP address 172.64.147.209 and was registered through Cloudflare, Inc. The domain was created on March 30, 2014, and currently appears on one active blocklist curated by OpenPhish. The SSL certificate is issued by Google Trust Services, which may contribute to a false sense of security due to its trusted CA status. Despite the reputable certificate authority, the domain’s age and clean registration history are being abused to host malicious content. Users are strongly advised to treat any link to kucixonlogen.gitbook.io as suspicious and avoid entering credentials on pages hosted there. Block the domain at the network perimeter and update endpoint protections to include the latest OpenPhish and VirusTotal signatures. Organizations should conduct phishing awareness training emphasizing URL verification and the risks of credential reuse across platforms. If credentials have been entered on this domain, immediately rotate passwords and enable multi-factor authentication wherever possible.