gxm2[.]top

The domain gxm2.top is currently active and classified as a high‑risk brand‑impersonation campaign targeting the brand "base". The site was registered on 22 October 2025 through Dynadot LLC and resolves to the IP address 188.114.97.3, which is hosted by Cloudflare (AS13335) in the United States. DNS resolution uses the Cloudflare authoritative nameservers aria.ns.cloudflare.com and arturo.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint despite the malicious intent. VirusTotal reports that eight of ninety‑five scanning engines flag the domain, and AlienVault OTX has referenced the domain in twenty‑seven threat‑intel pulses. Google Safe Browsing lists the domain under the "SOCIAL_ENGINEERING" category, and the site appears on two external blocklists, specifically ScamSniffer and PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The HTTP response returns status code 200 and the page title is "Titelseite", but no further content analysis is available. The campaign is identified as a crypto scam, suggesting attempts to deceive users into financial transactions. Defenders should block the domain at network and endpoint layers, monitor DNS queries for the associated IP and nameservers, and incorporate the indicator set (domain, IP, ASN, and blocklist references) into threat‑intel feeds. Continuous observation is recommended to detect any evolution of the payload or additional infrastructure tied to this campaign.