venom-team[.]gitbook[.]io

Analysis of venom-team.gitbook.io indicates that the domain is actively hosting a crypto‑drainer phishing campaign. The site presents the title "VENOM MULTI QR | VENOM TEAM Docs" and resolves to the IP address 172.64.147.209, which is owned by Cloudflare, Inc. The domain was registered through the GitBook service and carries an SSL certificate issued by Google Trust Services under the WE1 authority. HTTP traffic returns a 307 redirect, and the infrastructure leverages GitBook, Google Cloud, Cloudflare, HSTS, Google Cloud Trace, and HTTP/3. The page is listed on a single security blocklist and has been blocked by PhishDestroy. The Gridinsoft trust score is 0 / 100, reflecting a high risk assessment. VirusTotal records show that 91 scanning engines have examined the domain without reporting detections, though the absence of flags does not imply benign intent. Current classification places the domain under investigation with an active status. Defenders should treat the domain as malicious, block connections to the associated IP, and incorporate the domain into URL filtering and sink‑hole feeds. Monitoring for any changes in DNS resolution, additional blocklist listings, or new scanner detections is recommended to maintain situational awareness.