gwal32x[.]life

Analysis of the domain gwal32x.life shows it was created on 21 February 2026 and registered through URL Solutions, Inc. The authoritative nameservers are ns1.pananames.com, ns2.pananames.com, ns3.pananames.com and ns4.pananames.com. The site’s page title resolves to “GET‑X”, but no further content has been captured. Technical fingerprints indicate a stack built on Node.js with Vue.js and Nuxt.js, served by Nginx on cloud infrastructure that spans both Google Cloud and Amazon Web Services. The presence of reCAPTCHA and HTTP Strict Transport Security suggests an attempt to appear legitimate.

The SSL certificate received an R10 rating, while the Gridinsoft trust score is 0 out of 100, reflecting a lack of confidence in the host. VirusTotal scans recorded two detections out of ninety‑three security vendors, confirming that at least a minority of scanners flagged the domain as malicious. The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy service. Its risk level is classified as elevated, and the current operational status is offline.

Based on the observable evidence, the domain was likely used for a generic phishing campaign, although the specific target or credential‑stealing vector has not been disclosed. The combination of a recent registration date, low trust scores, limited vendor detections, and the “GET‑X” page title aligns with typical phishing infrastructure that is quickly taken down after detection. Defenders should add gwal32x.life to deny‑list rules across DNS resolvers, firewalls, and email gateways, and monitor the associated Pananames nameservers for any re‑registration attempts. Continued vigilance is advised, especially because the hosting environment spans major cloud providers that can be leveraged for rapid redeployment.