glllx[.]xyz

Analysis indicates that glllx.xyz was registered on February 21 2026 through NiceNIC International Group Co., Limited and is currently taken offline. The authoritative nameservers are cesar.ns.cloudflare.com and shubhi.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare’s network (ASN 13335) with the public IP address 104.21.43.174 located in the United States. TLS termination is provided by a Google Trust Services certificate (WE1), and HTTP responses include HSTS and HTTP/3, suggesting modern web‑stack configuration. The page title returned during the brief scan reads “GMX | Decentralized Perpetual Exchange,” while the listed scam type is “Brand Impersonation” with the brand target described only as “across,” indicating no single brand was explicitly identified in the available data. Threat intelligence shows that three of ninety‑five VirusTotal scanners flagged the domain as malicious, and Gridinsoft assigned a trust score of 0 / 100.

The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the classification as a malicious impersonation site. Detected third‑party components include jsDelivr, cdnjs, crypto‑js, Cloudflare Browser Insights, and Cloudflare services, all of which are commonly used in legitimate sites but can also be leveraged to host malicious scripts. Uncertainty remains regarding the specific brand or service being spoofed, as the page title references GMX—a legitimate email provider—yet the “brand target” field lists only “across.” No payload samples, credential‑harvesting forms, or URL paths have been disclosed, limiting the ability to attribute a particular phishing kit or attack vector. Consequently, defenders cannot confirm the exact user‑impact scenario beyond the generic brand‑impersonation risk.

Recommended actions for security teams include adding glllx.