gsana[.]live

The domain gsana.live is identified as a high-risk cryptocurrency wallet phishing operation. Analysis indicates this infrastructure was specifically designed to impersonate legitimate wallet interfaces, likely targeting users through credential harvesting and asset theft. The domain is currently offline, but prior activity confirms malicious intent. Infrastructure analysis reveals multiple concrete threat indicators. The domain was registered through HOSTINGER operations, UAB, and resolved to the IP address 88.222.222.97. It was flagged by 14 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and was created on March 22, 2026. Detected technologies include PHP, amCharts, Bootstrap, and jQuery, which are commonly exploited in phishing frameworks to mimic legitimate interfaces. Current status shows the domain has been taken offline, but the infrastructure remains a documented threat. Users who interacted with this domain should immediately revoke any connected wallet permissions, rotate credentials, and scan systems for malware. Organizations should update blocklists to include this domain and its associated IP address. Monitoring for similar domains registered through the same provider or resolving to the same IP range is recommended to prevent future exposure.