trezor-data[.]gxtigroup[.]com

trezor-data.gxtigroup.com is a subdomain of gxtigroup.com. PhishDestroy first recorded this hostname on Feb 26, 2026. The hostname explicitly references Trezor; stored content metadata identifies the same apparent target. The stored content classification is crypto scam. The assembled evidence scores 88/100 (high).

One independent source is positive: VirusTotal. VirusTotal recorded 11 detections among 93 engines: alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Kaspersky, Lionic, Sophos, VIPRE on Apr 23, 2026 at 02:20 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict.

HTTP 502 was recorded on Aug 7, 2026 at 16:30 UTC; content was unavailable. The recorded creation date for the registrable domain gxtigroup.com is Feb 21, 2026. Registration preceded first observation by 5 days. The stored server header is Apache. Captured page title: “Index of /”. DOM analysis completed on Mar 23, 2026 at 23:14 UTC; stored DOM score 73/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 1, 2026 at 04:29 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists R12 as the certificate issuer.