gymbot[.]guru

PhishDestroy identifies gymbot.guru as an active credential-phishing site that mimics a fitness automation service to trick visitors into surrendering login details. The domain was registered on April 05, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the IP address 104.21.68.138. A Let’s Encrypt SSL certificate lends a false air of legitimacy, but the site’s genuine purpose is to harvest usernames and passwords under the guise of granting access to a supposed gym automation tool.

This domain was flagged after VirusTotal scans returned 0 detections out of 95 security engines as of seed 00d6bb, indicating it remains under the radar for most antivirus and browser-blocking systems. The unusually recent registration date—April 05, 2026—coupled with the registrar choice, suggests a hastily deployed campaign aimed at capitalizing on trending fitness-related keywords before defenses catch up. Early detection remains critical because these pages often evolve to evade new detection signatures.

If you visited gymbot.guru, avoid entering any credentials and immediately scan your device with up-to-date antivirus software. Change passwords for the same email address on other sites only after confirming no unauthorized logins occurred. Report the domain to your browser vendor and to PhishDestroy to help block further abuse. Monitor financial accounts and enable two-factor authentication wherever possible to reduce risk from any information that may have been exposed.