gwcy12x[.]top

This domain, gwcy12x.top, is a confirmed brand impersonation threat designed to deceive users into believing it is an official Binance platform. The site presents itself as a registration portal for a purported "Getx" service, using the title "Getx сайт | Официальное зеркало для регистрации в игре 2025," which translates to a fake mirror for game registration. Analysis indicates the domain is engineered to harvest credentials or deploy crypto-draining malware, leveraging Binance's reputation to exploit users seeking cryptocurrency-related services. The Russian-language elements and gaming-themed pretext suggest targeting of Eastern European or Russian-speaking users, a common tactic in crypto-focused phishing campaigns.

Technical evidence confirms the malicious nature of gwcy12x.top. The domain was registered on April 18, 2025, through URL SOLUTIONS INC., a registrar frequently associated with high-risk domains. It resolves to the IP address 91.215.43.30 and is flagged by 3 out of 95 security vendors on VirusTotal, including detection as a phishing or malicious site. The domain appears on one security blocklist and has been assigned a trust score of 0/100, indicating no legitimacy. Infrastructure analysis reveals the use of modern web technologies such as Node.js, Vue.js, Nuxt.js, and Nginx, alongside Amazon Web Services hosting, which are often employed to create convincing fake interfaces. The presence of reCAPTCHA and Google Tag Manager further mimics legitimate platforms, increasing the likelihood of successful deception.

Users who visited gwcy12x.top or interacted with its content should take immediate action to mitigate potential risks. If credentials were entered, they must be changed immediately across all platforms, particularly Binance and any associated cryptocurrency wallets. Affected users should scan their devices for malware using updated security tools, as the site may have attempted to deliver crypto-draining scripts or other malicious payloads. Monitor financial accounts and transaction histories for unauthorized activity, and enable multi-factor authentication (MFA) on all critical accounts. Given the domain's offline status, users should remain vigilant for follow-up phishing attempts via email or social engineering, as threat actors may pivot to alternative domains or communication channels to continue their campaign.