gwas37x[.]life

gwas37x.life was registered through URL Solutions, Inc. on 21 February 2026 and resolves to the IPv4 address 186.2.165.80, which is announced by AS59692 (IQWeb FZ‑LLC) in the United Arab Emirates. The site returns HTTP 200 and presents the page title “GET‑X”. A Let’s Encrypt R12 certificate secures the connection, and the server reports HSTS, DDoS‑Guard, and Amazon CloudFront as protective layers. Network and application fingerprints show a modern stack built on Node.js with Vue.js and Nuxt.js frameworks, hosted on Amazon Web Services. The presence of DDoS‑Guard and CloudFront indicates the operators are leveraging third‑party mitigation services to obscure origin and maintain uptime. The domain is actively delivering a Gambler Scam phishing kit, which typically harvests credentials by masquerading as a gambling portal. Threat intelligence sources flag the domain as high‑risk. VirusTotal recorded 2 detections out of 95 scanned engines, while Gridinsoft assigned a trust score of 0 / 100. The domain is listed on one public blocklist and has been added to the PhishDestroy blocklist, confirming active abuse. Despite the low vendor detection count, the combination of a known phishing kit, high‑risk rating, and zero trust score warrants immediate attention. Defenders should add 186.2.165.80 and gwas37x.life to network deny lists and consider sinkholing the address to disrupt the phishing campaign. Continuous monitoring of DNS changes and TLS certificate renewal is advised, as the operators may shift infrastructure. Users should be warned about unsolicited gambling‑related communications that reference “GET‑X”, and credential‑phishing filters should be tuned to block similar patterns.