m[.]gmacworld[.]vip

The domain m.gmacworld.vip was registered on March 23, 2026 through Dynadot Inc. It is configured to use Cloudflare’s DNS service, with authoritative name servers aliza.ns.cloudflare.com and vicente.ns.cloudflare.com, and resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. The site was protected by an SSL certificate issued by Google Trust Services and employed HTTP Strict Transport Security (HSTS) as well as HTTP/3, indicating the use of modern web security protocols. Threat intelligence sources have placed the domain on a single public blocklist, and it is explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows that 14 of 94 scanned security vendors flagged the domain, suggesting malicious characteristics consistent with a phishing operation.

The domain’s current operational status is offline, limiting immediate observation of content or page titles. While the presence of a Google‑issued certificate and Cloudflare infrastructure does not guarantee legitimacy, the combination of recent registration, rapid appearance on blocklists, and multiple vendor detections aligns with a typical phishing deployment timeline.

Defenders should continue to enforce blocking of the domain at perimeter and endpoint layers, incorporate the domain into threat‑intel feeds, and monitor any future re‑registration attempts. Additional investigation is warranted if the domain becomes active again, focusing on payload delivery methods, targeted brands, and any associated command‑and‑control infrastructure.