tmxgm[.]com

This domain, tmxgm.com, is flagged as an active brand impersonation phishing site targeting TMGM, a known online trading platform. Registered on June 15, 2026, through GoDaddy Corporate Domains, LLC, the domain resolves to IP 104.21.15.224, hosted behind Cloudflare infrastructure in Canada. The page title, "TMGM: 最佳线上交易平台 - 顶级货币对和差价合约交易经纪商," explicitly references TMGM’s branding and services, confirming the impersonation intent. Analysis indicates the domain is currently active, returning an HTTP 302 redirect status, which is commonly used in phishing campaigns to obscure final landing pages or evade detection. Infrastructure review reveals Cloudflare nameservers (boyd.ns.cloudflare.com, rosalyn.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), typical of modern phishing setups leveraging legitimate CDN and certificate providers. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is referenced in two AlienVault OTX threat intelligence pulses. While 91 vendors scanned the domain on VirusTotal with no current detections, this absence does not confirm safety, as phishing domains often evade initial scans. Defenders should treat this domain as high-risk due to confirmed brand impersonation, active status, and blocklist presence. Recommended actions include immediate blocking at the DNS or network level, monitoring for related domains using similar naming patterns (e.g., tmgm variations), and alerting users to the TMGM impersonation threat. The domain’s recent registration and use of Cloudflare suggest it may be part of a larger, evolving campaign. Further analysis of redirect chains or associated infrastructure may reveal additional indicators of compromise.