gl[.]pwtwoh9[.]za[.]com

Analysis of gl.pwtwoh9.za.com shows a high‑risk generic phishing infrastructure that has been taken offline as of the report date. The domain resolves to 178.16.53.103, an address located in the Netherlands and announced by ASN AS202412 owned by Omegatech LTD. Registration data indicate the domain was created on 24 March 1998 and is managed through Sav.com, LLC with four centralnic.net nameservers (ns1‑ns4.centralnic.net). No TLS certificate is deployed, leaving all HTTP traffic unencrypted.

The only visible page title returned during the last crawl was “Site is created successfully!”. Google Safe Browsing classifies the URL as social engineering, and VirusTotal records 13 positive detections out of 93 scanning engines, confirming malicious intent. The domain appears on one external blocklist and is actively blocked by the PhishDestroy feed. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment.

Because the site is currently offline, dynamic content, payloads, or credential‑stealing forms cannot be verified, and the exact phishing campaign details remain unknown. Defenders should immediately block the domain and its resolved IP at perimeter and DNS layers, add the host to internal threat‑intel feeds, and monitor for any re‑hosting or resurrection attempts. Continuous observation of the AS202412 network for related activity is advised, as well as periodic re‑scans should the domain become reachable again. The lack of SSL and the low trust score further suggest the infrastructure is intended solely for malicious purposes rather than legitimate services.