tmgmforex[.]xyz

This domain is flagged as a generic phishing threat with high risk and remains active as of the report date. The page title claims to represent TMGM Forex, an online forex and CFD trading brand, but the domain itself was registered on May 20, 2026, through NAMECHEAP INC, a registrar often associated with low-effort or transient phishing setups. Infrastructure analysis shows the domain resolves to IP 185.158.133.1, hosted in Poland (PL) under AS13335 (Cloudflare, Inc.), which provides content delivery and DDoS protection, potentially masking the true origin server. The SSL certificate is issued by Google Trust Services (WE1), consistent with Cloudflare's proxy services. VirusTotal data indicates 2 out of 91 security vendors flag this domain, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX shows inclusion in one threat intelligence pulse. The Gridinsoft trust score is 0/100, reflecting strong suspicion. The nameservers are set to dns1.registrar-servers.com and dns2.registrar-servers.com, default Namecheap infrastructure. The domain is live and responding with HTTP status 200, but the specific content served beyond the page title has not been analyzed. Defenders should treat this as an active phishing infrastructure targeting forex traders, monitor for associated subdomains or IP changes, and consider blocking the domain at the network or email gateway level. Regular re-scanning is advised as the threat may evolve or pivot to new domains.