gmxdex[.]live

Analysis indicates that gmxdex.live is an active domain registered on February 21 2026 through Web Commerce Communications Limited. The domain is delegated to Cloudflare nameservers laylah.ns.cloudflare.com and major.ns.cloudflare.com, and resolves to the Cloudflare edge address 188.114.96.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 certificate authority, confirming that HTTPS is correctly configured, but the HTTP response returns a 403 status code, suggesting that legitimate content is being blocked or that the server is intentionally denying access to automated probes. The page title returned by the server is “gmx dex - Pioneering Decentralized Trading”, and the detected technology stack includes Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support.

The domain is classified as a brand impersonation scam targeting the GMX brand, and it appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL. A reputation check from Gridinsoft assigns a trust score of 0 out of 100, indicating extreme suspicion. VirusTotal analysis shows that one of ninety‑three security vendors flagged the domain, reinforcing the malicious assessment. Taken together, the infrastructure—use of Cloudflare’s CDN, a recent registration date, low trust score, blocklist listings, and a brand‑impersonation label—provides concrete evidence that gmxdex.live is being used to deceive users who expect legitimate GMX services.

The exact content served to end users has not been captured, so the precise phishing flow remains unknown. Defenders should block the domain at network perimeter, add it to URL filtering and web‑proxy deny lists, and monitor for any DNS queries to the associated IP address.