GTM
The same Google Tag Manager container initialization code (GTM-init) is deployed across 10 distinct scam domains, indicating shared analytics infrastructure used to track victims and coordinate operational metrics across a coordinated phishing network.
Fingerprint
gtm:gtm-init- Detections
- 11
- Hash type
- Tracking ID
- Status
- Active
- Last scanned
- May 2026
22026-03
62026-04
32026-05
Detected domains
11coatedf.cc
OnlineTrust 1Apr 7, 2026digitap.app
OnlineTrust 1Apr 7, 2026instaxchange.com
OnlineTrust 7Mar 28, 2026maicapital1.com
OnlineTrust 1Apr 7, 2026neverless.com
OnlineTrust 1Mar 24, 2026niza.io
OnlineTrust 19Apr 16, 2026ozak.ai
OnlineTrust 1Apr 7, 2026profit.com
OnlineTrust 1May 22, 2026runwago.com
OnlineTrust 25May 5, 2026tokenmax.net
OnlineTrust 20May 10, 2026