gwfg51x[.]life

The phishing domain gwfg51x.life, which imitated the GET-X brand, was flagged by 2 out of 95 vendors on VirusTotal. This domain was registered with URL Solutions, Inc. and hosted on an IP address in the United Arab Emirates under the organization IQWeb FZ-LLC. Despite its current offline status, it was initially detected by PhishDestroy on August 29, 2025.

The domain's SSL certificate was issued by Let's Encrypt, a common choice for phishing sites due to its free and automated nature. Its presence on a public blocklist, specifically PhishDestroy's, highlights its malicious intent. The low detection rate on VirusTotal at the time of its activity suggests it was relatively fresh, potentially exploiting the gap before antivirus databases could update their records.

The hosting IP, 186.2.165.80, located in the UAE, is associated with AS59692, operated by IQWeb FZ-LLC. This information can be crucial for identifying patterns in phishing operations, as certain registrars and hosting providers may be more frequently used by threat actors. The takedown of gwfg51x.life reduces its immediate threat, but the details surrounding its operation provide valuable insights for future threat assessments.