gwge86x[.]life

gwge86x.life is an active generic phishing site observed on July 12, 2026. The domain was registered on February 21, 2026 and immediately began serving content. Its risk rating is high, reflecting the presence of credential‑stealing infrastructure and multiple security detections.

Technical resolution points to the IPv4 address 91.215.43.30, which belongs to AS57724 operated by DDOS‑GUARD LTD in Russia. The domain is delegated to four name servers (ns1.pananames.com, ns2.pananames.com, ns3.pananames.com, ns4.pananames.com), indicating use of a commercial DNS provider. The web server presents a valid Let's Encrypt certificate (R13) and enforces HTTP Strict Transport Security. Front‑end technologies include Node.js, Vue.js, Nuxt.js, and Nginx, while the back‑end appears to be hosted on Amazon Web Services, as inferred from HTTP headers. reCAPTCHA and Google Tag Manager are loaded, suggesting attempts to bypass automated analysis.

Content delivered at the root URL returns HTTP 200 and carries the page title “GET‑X”. VirusTotal analysis shows that 2 of 95 scanning engines flag the domain, and the Gridinsoft trust score is 0 out of 100, indicating a consensus of malicious intent. The domain is listed on a single blocklist, currently PhishDestroy, confirming that at least one external sink has identified it as a phishing vector.

Defenders should prioritize outbound filtering for traffic to gwge86x.life and consider adding the domain to internal blocklists. Continuous monitoring of the associated IP address and its ASN is advised, as threat actors may pivot to adjacent hosts within the same provider. Incident response teams should treat any credential submissions to this site as compromised and advise affected users to reset passwords promptly.