kuckoimlogenz[.]gitbook[.]io

kuckoimlogenz.gitbook.io is an active phishing domain with an elevated risk level, posing as a legitimate GitBook instance to deceive users into entering sensitive information. PhishDestroy identifies this domain as a confirmed fraudulent host, leveraging Cloudflare’s infrastructure to evade detection while impersonating a trusted platform. The threat actor behind this domain employs generic phishing tactics, likely harvesting credentials or distributing malware under the guise of documentation or collaboration tools. PhishDestroy’s investigation confirms this domain was registered through Cloudflare, Inc., resolving to IP 172.64.147.209 with a Google Trust Services SSL certificate. The domain was created on March 30, 2014, and is currently blocked by OpenPhish, appearing on 1 security blocklist. VirusTotal flags this domain with a 18/95 detection rate, indicating partial but significant recognition as malicious by security vendors. The combination of a trusted SSL certificate, Cloudflare hosting, and long-standing registration suggests a deliberate attempt to bypass traditional security measures by blending into legitimate web traffic. Mitigation steps for this specific phishing threat require immediate action. Users should avoid interacting with kuckoimlogenz.gitbook.io entirely, as it is confirmed to host fraudulent content. Organizations should block this domain at the network level using threat intelligence feeds like OpenPhish to prevent accidental exposure. Additionally, security teams should audit logs for any past or ongoing connections to this domain, as it may indicate compromised credentials or internal reconnaissance. For end-users, enabling browser-based phishing protection (e.g., Chrome’s Safe Browsing) and verifying the legitimacy of links—especially those shared via unsolicited emails—are critical defenses against this and similar attacks.