gcxchoog[.]com

This domain, gcxchoog.com, is flagged as a high-risk generic phishing site targeting cryptocurrency users. Analysis indicates it mimics the branding of a cryptocurrency exchange, likely GCEX, to deceive victims into entering wallet credentials or transferring digital assets. The domain does not exhibit direct ties to known drainer kits but employs standard phishing tactics, including SSL encryption and a plausible page title to appear legitimate. Infrastructure analysis reveals the domain was registered on February 19, 2026, through Dominet (HK) Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 112.213.108.93, which has been linked to prior phishing campaigns. As of the latest scan, 15 out of 95 security vendors on VirusTotal flag gcxchoog.com as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by cryptocurrency wallet protection systems. Its SSL certificate, issued by Let's Encrypt, is a common tactic to evade browser security warnings. The domain is currently offline, reducing immediate risk to users. However, historical data suggests such domains may resurface under altered infrastructure or similar naming conventions. Response actions include continued monitoring of the IP and registrar for re-emergence, as well as cross-referencing with known phishing clusters. Users who interacted with this domain should revoke any connected wallet permissions, rotate credentials, and scan for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.