gwgc95x[.]top

Analysis of gwgc95x.top indicates a high-risk phishing domain targeting users of the GetX platform, as evidenced by the page title 'Гет Икс официальный сайт доступен через рабочее зеркало для игроков'. The domain was registered on February 21, 2026, through URL Solutions Inc., and currently resolves to IP address 186.2.165.80, hosted by Iqweb LLC in the United Arab Emirates. Infrastructure analysis reveals the use of nameservers ns1.pananames.com through ns4.pananames.com, a common pattern in phishing campaigns leveraging bulk domain registration services. Security vendor detections are limited but present: three of ninety-three engines on VirusTotal flag the domain as malicious, while PhishDestroy has explicitly blocked it.

The domain appears on at least one security blocklist, and Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. The SSL certificate is issued by R10, a provider frequently associated with low-reputation domains. The HTTP status code 200 confirms the site is currently active and serving content. Defenders should note that the domain's registration date suggests recent deployment, and its hosting in a jurisdiction with lax enforcement may complicate takedown efforts.

While the page title explicitly references GetX, no additional evidence confirms the exact nature of the phishing kit or payload. Organizations are advised to block the domain at the DNS or proxy level, monitor for related infrastructure (e.g., shared IP, registrar, or nameserver patterns), and alert users to the presence of this active mirror-themed phishing site. Further investigation into the IP 186.2.165.80 may reveal additional malicious domains hosted on the same infrastructure.