gmx-interface-with-etherspot-prime-sdk[.]pages[.]dev

PhishDestroy identifies gmx-interface-with-etherspot-prime-sdk.pages.dev as an active brand impersonation site targeting GMX users. This fraudulent domain clones the official GMX decentralized perpetual exchange interface to trick victims into connecting wallets or signing malicious transactions, posing significant risks to cryptocurrency assets. The site remains live as of the latest assessment with no confirmed takedown actions reported.

This domain was flagged by 0 out of 95 VirusTotal security vendors, indicating a lack of widespread detection at present. It is registered through Cloudflare, Inc., resolving to IP 172.66.45.14, and operates under a Google Trust Services SSL certificate. The exact creation date remains unverified, but the domain has been active long enough to establish a deceptive presence mimicking GMX’s branding and interface structure. The absence of VirusTotal detections suggests a potential zero-day threat or highly targeted campaign.

Given the confirmed impersonation of GMX, users are strongly advised to avoid interacting with gmx-interface-with-etherspot-prime-sdk.pages.dev entirely. Verify all links by cross-referencing the official GMX website (gmx.io) and ensure bookmarks point to the correct domain. Enable wallet transaction simulation tools where available and use hardware wallets for high-value transactions. Report this domain to GMX’s official support channels and VirusTotal if encountered, contributing to broader threat intelligence efforts.