gnx676[.]it

This domain, gnx676.it, was registered on February 21, 2026, and is currently flagged as a generic phishing site impersonating SaxoTrader, as indicated by the page title 'SaxoTrader'. Analysis reveals the domain has been taken offline as of the report date, July 23, 2026. Infrastructure details show it resolved to IP 188.114.97.3, hosted on Cloudflare's network (AS13335) in the US. The SSL certificate is classified as WE1, a low-trust indicator often associated with malicious or hastily configured sites. Detection data from security vendors is limited but notable: 14 of 93 vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist.

The domain was blocked by PhishDestroy, a phishing-specific detection service. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification. No additional details about the phishing kit, exact payload, or victim targeting are available at this time. Defenders should treat this domain as confirmed malicious due to its offline status, detection by multiple security mechanisms, and association with a known financial trading brand.

Block the domain and its resolved IP at perimeter security controls. Monitor for any attempts to re-register the domain or shift infrastructure to new IPs. If internal logs show user interaction with gnx676.it, initiate incident response procedures, including credential resets and endpoint scans for affected devices. Given the domain's short lifespan and offline status, further forensic evidence may be limited, but historical DNS and proxy logs should be reviewed for any prior connections.