gifxpartnersltd[.]com

Analysis as of July 27 2026 confirms that the domain gifxpartnersltd.com remains active and is being used in a generic phishing operation. The domain was registered on 3 August 2024 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on the IP address 64.20.38.219. DNS resolution is served by the authoritative nameservers dns2028a.trouble-free.net and dns2028b.trouble-free.net. VirusTotal reports that six of ninety‑one scanning engines have flagged the domain as malicious, indicating partial detection across the security community.

The domain is listed on one external blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the view that it is considered hostile by at least some protective products. No additional public intelligence such as page titles, SSL certificate details, or HTTP response codes has been published, so the exact content and lure techniques remain unknown. The limited detection footprint suggests that some security products have not yet incorporated indicators for this infrastructure, which could allow it to bypass certain automated defenses. Defenders should ensure that inbound and outbound traffic to 64.20.38.219 is monitored and, where possible, blocked.

Adding the domain and its nameservers to local deny lists, as well as confirming that endpoint protection solutions are updated to include the six VirusTotal‑identified signatures, will reduce exposure. Continuous monitoring of the domain’s reputation on VirusTotal and other aggregators is advised, as further vendor detections may emerge. Organizations that rely on email filtering should verify that phishing‑specific rules cover this domain, especially given its recent creation date and active status.