h5[.]gtcfxtrade[.]top

This domain, h5.gtcfxtrade.top, is identified as a high-risk cryptocurrency phishing site designed to impersonate the GTCFX brand. Analysis indicates the site employs social engineering techniques to deceive users into disclosing wallet credentials or transferring digital assets to attacker-controlled addresses. The infrastructure leverages modern web technologies, including Vue.js and Cloudflare services, which may obscure malicious activity behind legitimate-looking frontend frameworks. Infrastructure analysis reveals the domain was registered on April 30, 2026, through Spaceship, Inc., and resolves to the IP address 104.21.75.76. Detection metrics show 9 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing classifies it under SOCIAL_ENGINEERING. The domain appears on three security blocklists, and its Gridinsoft trust score is 0 out of 100, further confirming its malicious nature. At present, h5.gtcfxtrade.top has been taken offline, likely due to enforcement actions by hosting providers or registrars. However, residual risk remains, as associated infrastructure may persist or resurface under new domains. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and verify the legitimacy of any communications claiming affiliation with GTCFX.