gmoax[.]com

Analysis of the domain gmoax.com reveals infrastructure consistent with high-risk phishing activity. Registered on July 20, 2026, through Realtime Register B.V., the domain remains active as of July 23, 2026, and is flagged by one security blocklist, specifically PhishDestroy. The domain resolves to the IP address 99.84.152.23, which is associated with content delivery networks rather than dedicated hosting, a pattern commonly observed in phishing campaigns to obscure origin and enhance resilience. Nameserver configuration points to a.share-dns.com, a5.share-dns.com, b.share-dns.net, and b5.share-dns.net, a set known for hosting multiple low-reputation domains and linked to prior malicious activity.

VirusTotal scanning indicates that one of ninety-one security vendors has flagged gmoax.com, though the specific detection rationale and targeted brand remain unconfirmed. No additional context regarding page content, phishing kit, or victim brand is available at this time; the domain is classified as generic phishing based on infrastructure and detection patterns rather than confirmed impersonation of a specific entity. The absence of widespread vendor detection does not imply safety, as new domains often evade initial scans. Defenders are advised to treat this domain as active and high-risk.

Network-level blocking should be implemented, particularly for organizations using PhishDestroy or other reputation-based filters. Monitoring of the IP 99.84.152.23 and associated nameservers may reveal additional related domains. Further analysis, including SSL certificate inspection and HTTP response headers, is recommended to identify campaign linkages or kit signatures. Given the recent registration and active status, this domain is likely to be used in ongoing phishing operations targeting users within the next 24 to 72 hours.