gmgn-ai[.]one

The domain gmgn-ai.one was registered on March 11, 2026 through Spaceship, Inc. and is currently marked as active. The site presents a page titled “GMGN.AI | Blockchain Data Intelligence Platform” and returns HTTP 200, which aligns with the reported cryptocurrency‑focused phishing campaign. The public‑facing content tries to masquerade as a blockchain analytics service, a common lure for victims seeking crypto‑related services.

Network analysis shows the domain resolves to the Cloudflare edge address 104.21.64.215, belonging to AS13335 Cloudflare, Inc., located in the United States. Authoritative nameservers are eugene.ns.cloudflare.com and sreeni.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid, widely‑trusted certificate despite the malicious intent.

Multiple threat‑intel sources corroborate the malicious nature of gmgn-ai.one. The domain appears on three independent security blocklists and is flagged by PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the domain in two separate pulses, and VirusTotal records two out of ninety‑five scanners flagging it as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment.

Analysis gaps remain regarding the exact payload delivered to victims and the operational group behind the campaign; no additional infrastructure such as command‑and‑control servers has been publicly linked. Defenders should enforce DNS or proxy blocking for gmgn-ai.one, monitor TLS certificates for sudden changes, and consider sinkholing the associated IP address to disrupt traffic. Continuous re‑inspection of related Cloudflare‑hosted domains is advised, as the attacker may pivot to new subdomains or alternate registrations.