minergpt[.]org

The domain minergpt.org was registered on 21 February 2026 through Dominet (HK) Limited and is currently active. Its public page title reads “MINER GPT‑ Cloud Mining Platform”, a branding that mimics legitimate cryptocurrency services. The site is classified as a generic_phishing operation, and phishing‑specific blocklists have marked it as hostile. Infrastructure analysis shows the domain resolves to 104.21.77.46, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers are anita.ns.cloudflare.com and derek.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. The site serves HTTP 200 responses over TLS with a certificate labeled WE1 and advertises HSTS, HTTP/3, and common front‑end libraries such as Bootstrap, jQuery, Popper, and Google Analytics. Reputation data reinforces the malicious assessment. PhishDestroy has blocked the domain, and Gridinsoft assigns it a trust score of 1 out of 100. The domain appears on one known security blocklist, and VirusTotal reports that 2 of 95 scanned security vendors flag the site, consistent with a low‑confidence but non‑trivial detection. No additional malicious payloads or command‑and‑control infrastructure have been observed, leaving the precise phishing lures uncertain. Defenders should treat any traffic to minergpt.org as hostile. Immediate actions include adding the domain to network deny lists, monitoring DNS queries for the associated Cloudflare nameservers, and reviewing web proxy logs for HTTP 200 responses that contain the “MINER GPT‑ Cloud Mining Platform” title. Because the site leverages a reputable CDN, threat hunting should focus on credential‑harvesting forms or redirects that may be delivered after the initial page load. Continuous re‑evaluation is advised as additional security vendor detections may emerge.