giftcardmallgiftio[.]com

Analysis of the domain giftcardmallgiftio.com indicates a confirmed brand impersonation campaign targeting Mastercard, as evidenced by its page title 'GiftCardMall/MyGift - Balance Check and Activation' and explicit classification in threat intelligence sources. The domain was registered on February 22, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), with nameservers dora.ns.cloudflare.com and nero.ns.cloudflare.com, a configuration commonly observed in phishing operations leveraging Cloudflare's proxy services to obscure origin servers. Security vendor detections remain limited but notable: as of the latest scan, five of ninety-five security vendors on VirusTotal flagged the domain as malicious.

The domain appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft's trust score for the domain is 0 out of 100, further corroborating its malicious classification. No SSL certificate was observed, which is atypical for legitimate financial services but consistent with low-effort phishing infrastructure. The domain is currently offline, though its prior operational status and detection metrics suggest it was part of an active campaign.

Defenders should treat this domain as high-risk for Mastercard-branded phishing, particularly given its explicit targeting of gift card balance checks—a common social engineering vector. Organizations are advised to block the domain at the DNS and proxy levels, monitor for related registrations under the same registrar, and alert users to the impersonation of Mastercard's gift card services. Further investigation into the hosting infrastructure may reveal additional linked domains or campaigns.