uphilxdlogen[.]gitbook[.]io

This domain, uphilxdlogen.gitbook.io, is actively flagged as a high-risk phishing infrastructure targeting users through GitBook's hosting platform. Analysis indicates the domain was created on March 30, 2014, and is currently resolving to IP address 104.18.40.47, hosted under Cloudflare's network with nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. Security vendors have identified this as a social engineering threat, with Google Safe Browsing explicitly classifying it as such. The domain appears on two security blocklists and is blocked by PhishDestroy and OpenPhish, reinforcing its malicious classification.

VirusTotal reports that 11 out of 91 security vendors detect this domain as malicious, though the exact nature of the phishing content remains unverified due to lack of detailed page analysis. Defenders should note that the domain remains active as of July 30, 2026, and is likely leveraging GitBook's legitimate hosting to evade initial suspicion. The use of Cloudflare nameservers and hosting is consistent with phishing campaigns aiming to obscure origin and improve uptime.

While the specific brand or service being impersonated is not confirmed in available data, the social engineering classification suggests an attempt to deceive users into disclosing credentials or sensitive information. Network defenders are advised to block traffic to this domain at the DNS or proxy level, monitor for related subdomains or IPs within the 104.18.40.0/24 range, and review logs for connections to this infrastructure. Further investigation into the hosted content is recommended to determine the exact phishing mechanism and targeted entities.