gtioine[.]info

Analysis of gtioine.info indicates an active phishing infrastructure. The domain was registered on June 01, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently delegated to two authoritative name servers that belong to a well‑known content delivery network. DNS resolution points to the address 104.21.53.138, an IP hosted in Canada and associated with a large CDN operator. The site presents a valid TLS certificate from a public certificate authority and returns an HTTP 301 redirect, followed by a page whose title reads "Access to this page has been denied". Threat intelligence sources have marked the domain on a security blocklist, and PhishDestroy reports it as active. Google Safe Browsing flags the domain for social‑engineering content, and VirusTotal records detections from ten of ninety‑one scanning engines. Detected infrastructure components include caching and edge‑delivery layers, but specific product names are omitted per policy. The exact phishing payload or credential‑harvesting page has not been observed, leaving the malicious content unknown. Defenders should block the domain at network perimeter, update DNS filtering rules, and monitor for any outbound connections to the resolved IP. Continued surveillance of related hash and URL indicators is recommended to capture any evolving malicious payloads associated with this infrastructure.