gweh25x[.]top

The domain gweh25x.top is a phishing site engaged in brand impersonation, specifically targeting users of the Camelot platform. This site was designed to deceive visitors into believing they were interacting with a legitimate Camelot service, potentially leading to credential theft or financial fraud. As of the latest verification, gweh25x.top has been taken offline, though its prior activity poses residual risks to users who may have engaged with it.

Technical indicators confirm the malicious nature of gweh25x.top. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Trustwave, with Gridinsoft assigning a trust score of 0/100. It appears on 1 security blocklist, PhishDestroy, and was registered through the ripencc registrar on July 15, 2024. The domain resolved to the IP address 91.215.43.30, hosted by AS57724 (DDOS-GUARD LTD) in Russia, with no SSL certificate issued. The site returned an HTTP 530 status and had only one nameserver configured. Google Safe Browsing did not flag the domain at the time of assessment.

Users who may have interacted with gweh25x.top should take immediate safety steps. If credentials were entered, change passwords for the affected accounts and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity and report any suspected fraud to the legitimate service provider. Additionally, victims can report the phishing domain to their email provider, browser security teams, or platforms like the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.