gimp[.]my

Analysis of the domain gimp.my indicates a confirmed brand impersonation campaign targeting the brand 'across,' as classified by PhishDestroy. The domain was registered on September 01, 2025, through NameCheap, Inc., and is currently offline. Infrastructure analysis reveals Cloudflare-hosted nameservers (marty.ns.cloudflare.com, wanda.ns.cloudflare.com) and resolution to IP 172.67.198.139, located in the US under AS13335 (Cloudflare, Inc.). No SSL certificate was detected.

The page title, 'GIMP - Free and Open-Source Image Editor for Everyone,' does not align with the reported brand impersonation target, suggesting either a misconfiguration or an attempt to mislead users into believing the site is associated with the legitimate GIMP software project. The domain appears on one security blocklist, and 12 of 95 security vendors on VirusTotal flagged it as malicious. Gridinsoft assigned a trust score of 0/100, further corroborating its suspicious nature. Defenders should treat this domain as a high-confidence indicator of compromise (IOC) for brand impersonation.

While the domain is currently offline, historical resolution data and registration details should be used to update detection rules. The absence of an SSL certificate and the use of Cloudflare nameservers are consistent with low-effort phishing infrastructure. No evidence of a specific phishing kit or additional scam categorization (e.g., credential harvesting, malware distribution) is present in the available data. Further investigation into the hosting IP and associated domains may reveal additional compromised infrastructure.