gwfo63x[.]xyz

On 22 July 2026 the domain gwfo63x.xyz was observed as part of a generic phishing campaign. The site presented the page title “GET‑X” and was subsequently taken offline. The domain is registered through the RIPE NCC registry, and its DNS configuration contains a single nameserver. Resolution points to the IPv4 address 91.215.43.30, which belongs to the autonomous system AS57724 operated by DDOS‑GUARD LTD and is geolocated in the Russian Federation. No TLS certificate was associated with the host, indicating that the service was delivered over plain HTTP only.

Threat intelligence data show that the domain appears on one public blocklist and has been flagged by PhishDestroy. VirusTotal analysis recorded two positive detections out of ninety‑five scanners, confirming that a minority of security products recognized malicious activity. The Gridinsoft trust score of zero out of one hundred further reinforces the classification as malicious. The risk level assigned to the domain is elevated, reflecting the combination of low trust score, confirmed detections, and infrastructure hosted within a known proxy/hosting provider.

Available evidence does not disclose the specific credential‑harvesting technique, the target brand, or the content of the landing page beyond the title. Consequently, the exact phishing vector and any potential victims remain uncertain. Defenders should continue to block the domain at perimeter filters, update URL and IP reputation lists, and monitor for any resurgence of the same IP address or related AS numbers. Because the domain is already offline, incident response teams should focus on detecting any residual artifacts, such as emails that reference the GET‑X title or links to the former host, and enforce user education to avoid clicking unknown links.