girislinkim[.]com

Analysis of the domain girislinkim.com indicates it was operating as a generic phishing proxy infrastructure. Registered on February 23, 2026, through NiceNIC International Group Co., Limited, the domain resolved to the IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) and geolocated in the United States. The domain was hosted behind Cloudflare nameservers clara.ns.cloudflare.com and yew.ns.cloudflare.com, and employed Cloudflare Browser Insights alongside HTTP/3 for traffic optimization. An SSL certificate issued by Google Trust Services (WE1) was present, though this alone does not indicate legitimacy, as certificates are routinely issued to malicious domains.

The page title 'Welcome to nginx!' suggests the domain was configured as a reverse proxy or staging endpoint, a common tactic used to mask phishing kits or redirect victims to credential-harvesting pages. At the time of assessment, the domain returned an HTTP 200 status code, though it has since been taken offline. It appeared on one security blocklist (PhishDestroy) and was flagged by 2 out of 93 security vendors on VirusTotal, confirming detection by multiple independent engines. Gridinsoft assigned a trust score of 0/100, further supporting its classification as malicious.

While the exact phishing campaign or targeted brand remains unconfirmed due to the generic page title and lack of additional forensic data, the infrastructure aligns with known phishing proxy patterns. Defenders should treat this domain as compromised and block it at the DNS and network perimeter levels. Monitoring for newly registered domains under the same registrar or nameserver configuration may help identify related threats. The domain’s current offline status does not preclude future reactivation, and historical logs should be reviewed for prior connections.