gmgn-ai[.]icu

The domain gmgn-ai.icu was registered on January 26, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently listed as offline. DNS resolution points to the IP address 172.67.141.200, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative name servers are gabe.ns.cloudflare.com and lina.ns.cloudflare.com, confirming that the site was hosted behind Cloudflare’s edge network. No SSL certificate is presented for the domain, and an HTTP request returns the generic page title "Just a moment..." indicating that the site may have been serving a placeholder or interstitial page before being taken down.

Independent threat‑intel feeds have recorded the domain on a single security blocklist and it is actively blocked by the PhishDestroy filtering service. VirusTotal analysis shows that five of ninety‑five scanning engines flagged the domain, reinforcing the phishing classification. The Gridinsoft trust score is 0 / 100, a rating that typically denotes a highly malicious reputation. Taken together, the evidence points to a phishing operation that leveraged Cloudflare’s infrastructure to mask its true origin, employing a minimal surface page that likely redirected victims to credential‑stealing assets.

Because the site is now offline, immediate impact is limited, but the hosting environment and the observed indicator set suggest a reusable template that could be redeployed under a different domain. Defenders should continue to block the IP 172.67.141.200 at the network perimeter, enforce DNS filtering for gmgn-ai.icu, and monitor Cloudflare‑associated domains that exhibit similar registration patterns or low trust scores. Ongoing vigilance for new domains registered through the same registrar or using the same name‑server pair is recommended, as the underlying phishing kit may be re‑hosted elsewhere.