gwcm65x[.]life

The domain gwcm65x.life was registered on February 21, 2026 through a registrar operated by URL Solutions, Inc. It resolves to the IPv4 address 91.215.43.30, which is announced by AS57724 and associated with a Russian DDoS mitigation provider. The HTTP response is a permanent redirect (301) and the TLS certificate is issued by Let’s Encrypt (R13), indicating a recently obtained certificate. The page title returned from the site is "GET-X".

Infrastructure analysis shows the server is built on a Node.js stack with Vue.js and Nuxt.js frameworks, hosted on Amazon Web Services and fronted by Amazon CloudFront. HTTP Strict Transport Security (HSTS) is enabled, and the traffic is routed through DDoS‑Guard, confirming the Russian hosting attribution. The domain uses four nameservers under the pananames.com domain, suggesting a typical shared DNS configuration.

Threat intelligence sources flag the site as a generic phishing host. VirusTotal reports that 1 of 95 security vendors flagged the domain, and it appears on a single security blocklist. The Gridinsoft trust score is 0 out of 100, and the domain has been blocked by PhishDestroy, reinforcing the malicious classification. No additional vendor or kit attribution is available beyond the generic phishing label.

Defenders should add gwcm65x.life to domain block lists and monitor outbound connections to 91.215.43.30. Email security gateways should be configured to reject messages containing URLs that resolve to this domain, and web proxies should enforce TLS inspection to detect the GET-X page title. Continuous observation of the associated IP range and the DDoS‑Guard AS may reveal further malicious infrastructure linked to this campaign.