Analysis of gzxlab.info indicates that the domain was registered on July 28, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. DNS resolution points to the IPv4 address 188.114.97.3, and the domain is served by Cloudflare nameservers alina.ns.cloudflare.com and gabe.ns.cloudflare.com. VirusTotal has processed the domain with 91 vendor scans and has not produced any detections, although the absence of detections does not constitute a safety guarantee.
The domain appears on a single security blocklist and has been explicitly flagged by the PhishDestroy blocklist, demonstrating that at least one external threat intelligence source has identified it as malicious. No public information is available regarding SSL certificate details, HTTP response codes, page title, or any brand targeting, and the site’s content has not been publicly analyzed. Consequently, the current evidence base consists primarily of registration data, hosting information, and blocklist presence.
Defenders should treat gzxlab.info as a high‑confidence phishing indicator: network perimeter controls should block traffic to both the domain and its resolved IP address, DNS filtering should deny resolution, and endpoint security solutions should incorporate the domain and IP into their malicious indicator lists. Continuous monitoring of the domain’s reputation, additional VirusTotal scans, and correlation with any observed credential‑theft activity are recommended to confirm the scope of the campaign and to adjust mitigation measures as further intelligence becomes available.