gmgn[.]tw

Analysis of the domain gmgn.tw indicates it was actively impersonating the Solana brand as part of a phishing campaign. The domain was registered on February 21, 2026, through Epag.de and configured with Cloudflare nameservers (addyson.ns.cloudflare.com and kurt.ns.cloudflare.com). Infrastructure analysis reveals it resolved to the IP address 172.67.157.175, hosted on Cloudflare's network (AS13335) in the United States. At the time of assessment, the domain lacked an SSL certificate and was offline, though its page title, 'GMGN.AI 交易平台,' suggested a trading platform context, aligning with the reported scam type of brand impersonation targeting Solana.

Detection data shows the domain was flagged by three security blocklists and identified as malicious by one of 93 security vendors on VirusTotal. It was also blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing threat. The Gridinsoft trust score of 0/100 further supports its high-risk designation.

While the exact content and functionality of the site remain unanalyzed, the available evidence confirms its use in a brand impersonation scheme. Defenders should treat this domain as compromised and maintain blocks on any associated infrastructure, including the observed IP and Cloudflare nameservers. Monitoring for re-registration or similar domains using the same registrar or hosting patterns is recommended.