gmgn-net[.]web[.]app

Analysis of gmgn-net.web.app indicates that the site is currently offline, returning an HTTP 404 status for the sole observed page. The page title that was captured before the takedown reads "Trenches - GMGN.AI Fast Trade, Fast Copy Trade, Fast AFK Automation," suggesting a focus on automated trading services, but no content is available for deeper inspection. The domain resolves to the IPv6 address 2620:0:890::100, which belongs to the Fastly network (AS54113) located in the United States. Hosting is provided through Google Cloud infrastructure, as evidenced by the registrar entry for Google LLC, the use of Firebase, the presence of HTTP/3 and HSTS, and an SSL certificate issued by Google Trust Services under the WR4 profile. Nameservers are listed as ns-cloud.googledomains.com, confirming the Google-managed DNS configuration.

Reputation data shows that the domain is listed on five security blocklists and has been actively blocked by industry‑specific filters including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. Google Safe Browsing classifies the site as a social engineering threat, and VirusTotal reports that 8 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. While the exact payload or credential‑harvesting mechanisms cannot be confirmed due to the 404 response, the combination of a trade‑related page title, social‑engineering labeling, and multiple independent blocklist entries strongly suggests a phishing campaign targeting users interested in fast or automated trading.

Defenders should add gmgn-net.web.app to deny‑list configurations at network and endpoint layers, monitor DNS queries for the domain and its associated IPv6 address, and enforce TLS inspection to capture any potential encrypted traffic should the site become active again.