gweh88x[.]life

The domain gweh88x.life was registered on February 21, 2026 through URL Solutions, Inc. and is presently active. The site returns an HTTP 200 response and presents a page title identical to the domain name, a pattern frequently observed in credential‑phishing operations. Two of ninety‑five security vendors on VirusTotal have flagged the domain, and it appears on a single external blocklist. PhishDestroy has already listed the host as malicious, reinforcing the consensus that the site is being used for phishing. The overall risk rating is high, and the Gridinsoft trust score of 0 out of 100 reflects a complete lack of reputation.

Infrastructure analysis shows the domain resolves to the IP address 91.215.43.30, which is hosted in Russia and associated with Ddos‑guard LTD. The SSL certificate presented is labeled “R11,” indicating the use of a self‑signed or low‑trust certificate that does not provide meaningful encryption assurances. Four nameservers—ns1.pananames.com, ns2.pananames.com, ns3.pananames.com, and ns4.pananames.com—are configured for the domain, a common setup for rapidly provisioned malicious sites that rely on generic DNS services. No additional infrastructure details such as ASN or CDN usage are disclosed, leaving the precise hosting environment uncertain.

The evidence points to a credential‑phishing campaign targeting users who may be lured by the domain’s innocuous appearance. The combination of a newly created domain, a low‑trust SSL certificate, a Russian‑based IP address, and active blocklist entries aligns with known tactics used by phishing actors to harvest login credentials. Defenders should block the domain at the DNS and proxy layers, monitor outbound traffic for connections to 91.215.43.30, and update email filtering rules to flag any messages containing links to gweh88x.life. Continuous observation of the associated nameservers is advised, as they may be reused for future malicious domains.