gicoin[.]trade

The domain gicoin.trade is currently active and classified as a high‑risk brand‑impersonation threat targeting Revolut. The site resolves to IP 169.61.89.200, which belongs to IBM Cloud (AS36351) and is geolocated in the United States. Registration data show the domain was created on February 26, 2025 through Name.com, Inc., and it is served by four distinct name servers (ns4lny.name.com, ns3gnv.name.com, ns1kpv.name.com, ns2nsw.name.com). An HTTP request returns a 200 status code and the page title is reported as "GIC". Technical fingerprints indicate the presence of Bootstrap, Nginx, Unpkg, OWL Carousel, jQuery, and AOS libraries, and the TLS certificate is issued by Let’s Encrypt under the R13 profile. The domain appears on a single security blocklist and is flagged by PhishDestroy. It is referenced in one AlienVault OTX pulse, and one of ninety‑five VirusTotal scanners has raised a detection. The Gridinsoft trust score of 0/100 further underscores its malicious nature. While the exact content of the landing page has not been analysed, the combined evidence – IP hosting, registration timeline, technology stack, blocklist presence, and low trust score – confirms a deliberate attempt to impersonate Revolut. Defenders should block network resolution to 169.61.89.200, add gicoin.trade to URL filtering rules, monitor for related email traffic using the listed MX hosts (mx1.titan.email, mx2.titan.email), and consider sharing the indicator with upstream threat‑share platforms. Continuous re‑scanning is advised to capture any changes in the site’s behavior.