gwdp92x[.]life

The domain gwdp92x.life was registered on February 21, 2026 through URL Solutions, Inc. It resolves to the authoritative name servers ns1.pananames.com, ns2.pananames.com, ns3.pananames.com and ns4.pananames.com. The site serves content over HTTPS using an R13‑issued certificate and returns HTTP 200 responses. Technical fingerprinting shows the presence of Node.js, Vue.js, Nuxt.js, Amazon Web Services, HSTS, DDoS‑Guard and Amazon CloudFront, indicating a modern web stack hosted on cloud infrastructure. The site is currently classified as a high‑risk generic phishing campaign and remains active. VirusTotal analysis recorded two positive detections out of ninety‑five security vendors, and the Gridinsoft trust score is 0 out of 100, reflecting a lack of confidence in the domain’s legitimacy. It appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. While the page title “GET‑X” is the only visible indicator of the payload, the exact content and credential‑harvesting mechanisms have not been publicly disclosed, leaving the precise phishing vector unclear. No additional intelligence on targeted brands or victim demographics is available, and the limited number of vendor detections suggests that the campaign may be in early deployment or employing evasion techniques that bypass some scanners. Defenders should add gwdp92x.life to network‑level deny lists, enforce DNS‑based filtering, and monitor outbound traffic for connections to the identified name servers and CloudFront endpoints. Continuous re‑scanning with multiple analytics platforms is advised to capture any evolution in detection rates. Organizations using the same cloud providers should review credential reuse policies and enable multi‑factor authentication to mitigate potential credential compromise originating from this site.