gweo97x[.]life

The domain gweo97x.life was registered on 21 February 2026 through URL Solutions, Inc. and is currently flagged as a high‑risk generic phishing site. Analysis shows the site returns an HTTP 301 redirect and presents the page title “GET‑X”, indicating a likely credential‑harvesting front‑end. The domain resolves to the IPv4 address 186.2.165.69, which is allocated to an Iqweb LLC network in the United Arab Emirates. Infrastructure observations reveal a web stack built on Node.js with Vue.js and Nuxt.js components served behind an Nginx reverse proxy on Amazon Web Services. The site enforces HTTP Strict Transport Security and includes Google Tag Manager and Google Analytics scripts, suggesting a conventional marketing layer. DNS is hosted on four pananames.com name servers (ns1‑ns4.pananames.com). Threat intelligence indicates the domain appears on a single public blocklist and has been actively blocked by PhishDestroy. VirusTotal scans report two of ninety‑five security vendors flagging the host, while Gridinsoft assigns a trust score of zero out of one hundred. The SSL certificate is identified as “R11”, and the combination of a fresh registration date, high‑risk rating, and active status reinforces the suspicion of a phishing operation. Defenders should add gweo97x.life to network and email filtering rules to prevent connections and message delivery. Continuous DNS monitoring is advised to detect any future CNAME or A‑record changes. Incident response teams should collect HTTP headers, redirect chains, and any payloads for forensic correlation. Sharing this indicator set with upstream threat‑sharing platforms will help accelerate broader mitigation.