gfsc[.]us

Analysis of the domain gfsc.us indicates confirmed brand impersonation targeting Aptos cryptocurrency wallet users, specifically mimicking TokenPocket as evidenced by the page title 'TokenPocket - 您的多链数字钱包'. The domain was registered on February 21, 2026, through Dominet (HK) Limited and currently holds a Gridinsoft trust score of 0/100, reflecting high-risk classification. Infrastructure analysis reveals the domain resolves to IP 47.242.190.153, hosted on Alibaba (US) Technology Co., Ltd. (AS45102) in Hong Kong, with nameservers ns7.alidns.com and ns8.alidns.com. No SSL certificate is present, increasing the likelihood of unencrypted credential harvesting.

Detection data shows the domain appears on one security blocklist and is flagged by 16 of 95 security vendors in VirusTotal, though the absence of additional context limits attribution to specific malware families or phishing kits. AlienVault OTX records the domain in two threat intelligence pulses, corroborating its malicious classification. The domain was taken offline following blocking by PhishDestroy, though defenders should treat its infrastructure as potentially reusable for future campaigns. Defenders are advised to block the domain, IP, and associated nameservers at perimeter controls.

Cryptocurrency wallet users should be alerted to the impersonation of TokenPocket, particularly given the domain's focus on multichain digital wallets. While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, lack of SSL, and detection by multiple vendors confirms its malicious intent. Monitoring for reuse of the hosting provider (AS45102) and registrar (Dominet HK) is recommended for proactive threat hunting.