ga-zi[.]store

The domain ga-zi.store has been identified as a phishing infrastructure impersonating a Chinese-language consignment service platform, specifically targeting users through the fraudulent branding of "千寻寄售服务平台." Analysis confirms this domain is designed to facilitate credential harvesting and financial fraud under the guise of a legitimate marketplace. Current evidence classifies it as a generic phishing threat with an elevated risk level due to its targeted deception tactics. Infrastructure analysis reveals the domain was registered on May 28, 2026, through NameCheap, Inc., and resolves to the IP address 43.174.247.24. Security telemetry shows it has been flagged by 1 of 95 vendors on VirusTotal, indicating limited but confirmed detection. The domain appears on three distinct security blocklists, reinforcing its malicious classification. The SSL certificate, issued by Let's Encrypt (identifier YE2), provides encryption but does not validate legitimacy, a common tactic in phishing operations to evade basic scrutiny. As of the latest assessment, ga-zi.store has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a latent threat due to the potential for rapid reactivation or migration to similar domains. Organizations and users are advised to block the domain and associated IP at perimeter defenses, monitor for related registrations under the same registrar, and conduct retrospective log analysis for prior connections. Individuals who interacted with the site should assume credential compromise and initiate password resets on any associated accounts, particularly those tied to financial services.