gptai-fx[.]com

This domain is flagged as a high-risk crypto credential theft site targeting users through deceptive interfaces designed to harvest wallet credentials and private keys. Analysis indicates the infrastructure is specifically engineered to mimic legitimate cryptocurrency platforms, increasing the likelihood of successful compromise for unsuspecting victims. Infrastructure analysis reveals the domain gptai-fx.com was registered on February 21, 2026, through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn). It resolves to IP address 193.218.201.141, hosted on AS201106 (Spartan Host Ltd) in the United States. The domain currently holds no SSL certificate and is detected by 12 out of 95 security vendors on VirusTotal. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, confirming its malicious classification. The domain has since been taken offline, though residual risk remains for cached or mirrored instances. To mitigate exposure, users should immediately revoke any permissions granted to gptai-fx.com in wallet applications and browser extensions. Verify domain authenticity before entering sensitive credentials by cross-referencing official project URLs. Enable hardware-based or multi-signature wallet protections to reduce the impact of credential theft. Network-level blocking of the IP 193.218.201.141 and associated domains registered through the same registrar is recommended for enterprise environments. Monitor wallet transactions for unauthorized activity and report any suspicious interactions to relevant security teams.