gwdv74x[.]space

Analysis of the domain gwdv74x.space, observed as an offline generic phishing infrastructure, indicates that the site was registered on February 21 2026. VirusTotal scans show three of ninety‑five security vendors flagged the domain, suggesting a low but non‑zero detection rate. The domain is listed on a single public blocklist, PhishDestroy, which currently blocks traffic to the host. The SSL certificate associated with the host is identified as R11, but no further certificate metadata such as issuer or validity period is available in the public record. HTTP probing confirms the site returns no active content, consistent with the reported offline status.

Available intelligence does not reveal the hosting provider, IP address, ASN, or geographic location, limiting the ability to correlate this host with other campaigns. The page title, targeted brand, or specific phishing kit were not captured, leaving the exact lure and victim profile uncertain. The limited detection footprint and solitary blocklist entry suggest the domain may have been used briefly or is part of a low‑volume operation that was quickly taken down. The elevated risk rating assigned by the reporting system reflects the combination of recent creation date, presence on a phishing‑specific blocklist, and the fact that multiple vendors have identified malicious behavior. Although only three vendors flagged the domain, those detections typically correspond to heuristic or URL‑based payload analysis, indicating that the site likely hosted a credential‑harvesting page or a redirect chain typical of generic phishing operations.

The lack of additional public detections may be due to the short lifespan of the host before takedown. Because the site is offline, no live HTTP response headers, content hashes, or JavaScript artifacts are available for further forensic analysis, preventing a complete attribution of the phishing kit or the threat actor behind the campaign.