gn3co098[.]cc

The domain gn3co098.cc was created on September 12, 2025 through the registrar NameSilo, LLC. It resolves to the IP address 134.122.166.179, which is allocated to AS152194 (CTG Server Limited) in Japan. The domain is served by the Cloudflare nameservers becky.ns.cloudflare.com and conrad.ns.cloudflare.com, but it does not present an SSL certificate, indicating that the site was only reachable via HTTP. The observed page title, "TK-Store | buy, sell and discover on TK," suggests a marketplace‑style landing page, while the listed brand target is "across," classifying the activity as a brand impersonation campaign. Detection evidence shows the domain appears on one security blocklist and is actively blocked by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low reputation. AlienVault OTX has incorporated the domain into 17 threat‑intelligence pulses, and VirusTotal reports that 16 of 95 scanned security vendors flagged the domain as malicious. As of the report date (July 24, 2026) the domain is listed as taken offline, and no SSL certificate or HTTPS service is observed, limiting current attacker interaction. However, the presence on multiple intelligence feeds and the low trust score indicate a credible risk that the infrastructure could be re‑activated or reused in future campaigns.

Uncertainties remain regarding the exact phishing payload, credential‑stealing mechanisms, or whether the site ever displayed a login form. No additional content analysis is available beyond the page title, and the short lifespan of the domain limits behavioral data. Defenders should block gn3co098.cc at the DNS and proxy layers, incorporate the IP 134.122.166.179 into outbound filtering rules, and monitor for new domains registered with NameSilo that resolve to the same ASN. Continuous review of OTX and PhishDestroy updates is recommended, as well as periodic rescanning with multi‑engine services to detect any re‑emergence of the site.