gauntlent[.]xyz

The domain gauntlent.xyz is currently active and flagged by 7 out of 91 vendors on VirusTotal as malicious. This domain, registered through Dynadot Inc and hosted on an Amazon IP address, is identified as a phishing threat. It has been operational since January 2026 and was first detected by PhishDestroy in June 2026.

The domain's hosting IP, 54.215.31.113, is located in the United States and is part of Amazon's network infrastructure. The SSL certificate for gauntlent.xyz is issued by Let's Encrypt, a common choice for malicious actors due to its free and automated nature. Despite its recent creation, the domain has already been added to one public blocklist, including PhishDestroy's own list.

With a platform risk score of 78 out of 100, gauntlent.xyz represents a significant threat level. The abuse score is relatively low at 21, indicating that it may not yet be widely reported or recognized. However, the presence of multiple VirusTotal detections suggests that the domain is actively involved in phishing activities, likely targeting unsuspecting users to harvest sensitive information.

The combination of its active status, multiple VirusTotal detections, and inclusion in public blocklists underscores the importance of early detection and response to such threats. PhishDestroy's identification of this domain highlights the ongoing challenge of combating phishing operations, particularly those exploiting legitimate services like Let's Encrypt for SSL certification.