gpt-forex-kr[.]com

Analysis of gpt-forex-kr.com indicates it is an active investment scam domain registered on September 11, 2025, through Alibaba Cloud Computing Ltd. under the HiChina registrar. The domain resolves to IP address 134.122.205.84, hosted on AS152194 (CTG Server Limited) in Hong Kong. Nameservers are configured as n1.xundns.com and n2.xundns.com, and the site presents an HTTP 200 status, suggesting it is fully operational. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The page title matches the domain name, but no specific brand or platform is confirmed in available data. Security vendors have flagged this domain on two blocklists, including PhishDestroy and ScamSniffer, and three of 93 engines on VirusTotal detect it as malicious. Gridinsoft assigns a trust score of 0/100. While the domain is classified as an investment scam, the exact mechanics—such as fake trading platforms, account takeover schemes, or fraudulent returns—remain unconfirmed due to limited public analysis of the site content. Defenders should treat this domain as high-risk and consider blocking it at the DNS or network level. Further investigation may reveal additional infrastructure or associated campaigns, but current evidence supports immediate mitigation.