ai-isaac[.]gitbook[.]io

This domain is flagged as an elevated-risk crypto scam impersonating the AI ISAAC ecosystem through a fraudulent whitepaper. The threat type involves distributing malicious content under the guise of legitimate technical documentation, likely targeting cryptocurrency users or investors seeking project details. Analysis indicates the domain was designed to deceive victims into engaging with fake investment opportunities or downloading malicious payloads disguised as official project materials.

Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to IP 104.18.40.47, hosted on Cloudflare's network (AS13335). The domain was created on March 30, 2014, though the malicious activity appears recent. It is currently offline but remains flagged by 1 security blocklist and detected by 11 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. The page title, 'AI ISAAC Ecosystem Whitepaper | AI ISAAC,' directly mimics authentic project documentation to enhance credibility.

Mitigation steps for this threat include blocking the domain and its associated IP (104.18.40.47) at the network level. Organizations should update endpoint protection rules to flag or quarantine any downloads originating from gitbook.io subdomains impersonating AI or blockchain projects. Users who accessed the domain should verify wallet addresses, revoke any suspicious smart contract approvals, and monitor accounts for unauthorized transactions. Security teams are advised to audit logs for connections to the domain or IP and review any whitepaper downloads from unknown sources for embedded malicious links or scripts.