gwdy92x[.]xyz

Analysis of the domain gwdy92x.xyz indicates that it was registered on February 21, 2026 and is currently taken offline. The site resolves to the IP address 76.223.26.96, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate presented by the host is identified as R11, but no further validation details are available. The page title returned from the HTTP response is the literal string "gwdy92x.xyz," providing no clues about the targeted brand or service.

Reputation services show a mixed signal: six of ninety-three VirusTotal scanners flagged the domain, suggesting the presence of malicious indicators, while the remaining vendors reported it as clean. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence in its malicious nature. The combined evidence points to a generic phishing operation, though the specific victim brand or credential‑stealing technique has not been disclosed.

Uncertainty remains regarding the exact payload, the phishing kit employed, and whether any victim data were harvested before the takedown. Defenders should continue to monitor the IP address 76.223.26.96 for any future re‑use, enforce blocklist rules that include this domain, and consider adding the associated ASN (AS16509) to broader threat‑intel feeds. Organizations employing URL filtering, endpoint detection, and email security gateways should ensure they block the domain and any URLs that resolve to the same IP, as well as investigate any logs for prior connections to gwdy92x.xyz before its offline status.