gwfa45x[.]life

Analysis of gwfa45x.life shows a newly registered domain (creation date 21 February 2026) linked to a high‑risk crypto scam profile. The domain is hosted on IP 91.215.43.30, an address attributed to Ddos-guard LTD in Russia, and resolves through four Pananames nameservers (ns1‑ns4.pananames.com). Infrastructure indicators include a Gridinsoft trust score of 0/100 and an HTTP 301 redirect, suggesting purposeful traffic manipulation. The site presents a "Privacy error" page title and carries an SSL certificate rated R10, yet it has been flagged by PhishDestroy and appears on one external blocklist. VirusTotal scanning recorded a single positive detection out of 93 vendors, reinforcing suspicion. Registration was performed via URL Solutions, Inc., a registrar often associated with abusive registrations. While the exact page content beyond the title remains unverified, the convergence of low trust scoring, malicious blocklisting, a crypto‑scam classification, and the Russian‑based hosting infrastructure provides concrete evidence of malicious intent. Defenders should block the domain at network perimeters, monitor DNS queries for the associated IP and nameservers, and consider adding the IP to threat‑intel feeds. Continuous re‑evaluation is advised should additional detections emerge.