gwar60x[.]life

gwar60x.life is currently active and serves a page titled GET‑X. The site is reachable via HTTPS using a Let’s Encrypt R12 certificate, indicating recent certificate issuance. DNS resolution points to 186.2.165.80, an address allocated to AS59692 IQWeb FZ‑LLC in the United Arab Emirates. The HTTP response is a 301 redirect, and the underlying stack includes Nginx front‑end, Node.js runtime, and a Vue.js/Nuxt.js application hosted on Amazon Web Services. Security‑hardening headers such as HSTS are present, and the page loads Google Tag Manager and Google Analytics scripts. The domain was registered through URL Solutions, Inc. and is listed on a single public blocklist; PhishDestroy has already taken the domain offline in its feed. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports 2 detections out of 95 scanners, confirming at least minimal malicious classification. The limited detection count suggests a low‑profile campaign, but the combination of phishing‑related blocklist entry, low trust score, and active hosting indicates a high risk to users. Defenders should add the IP address and fully qualified domain name to outbound and inbound filtering rules, monitor DNS queries for the host, and enforce TLS inspection to capture any credential‑harvesting traffic. Continuous re‑scanning with multi‑engine services is advised to detect any change in the detection profile. Until the site is taken down, organizations should treat any communication referencing GET‑X as malicious.