gwcs49x[.]space

The domain gwcs49x.space was registered on February 21, 2026 and is presently taken offline. Technical indicators show that it resolves to the IPv4 address 91.215.43.30, which is announced by AS57724 DDOS-GUARD LTD and geolocated to the Russian Federation. The host is associated with a TLS certificate identified as R11, confirming that HTTPS is served for the site. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trust.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal analysis reports that three of ninety‑three scanned security vendors flagged the domain, providing limited but corroborating evidence of malicious intent. No additional intelligence regarding the targeted brand, page title, or specific phishing kit is available, and the content of the site has not been publicly examined.

Given the combination of a low trust score, presence on a blocklist, SSL provisioning, and multiple vendor detections, defenders should treat gwcs49x.space as a confirmed phishing infrastructure. Recommended mitigation steps include adding the domain and its resolving IP address to network‑level deny lists, updating endpoint and email security policies to block communications with the host, and monitoring for any re‑registration attempts or related domains that may reuse the same IP range or certificate characteristics. Continuous observation of threat‑intel feeds for new detections linked to AS57724 is advised to pre‑empt potential resurgence of the campaign.