gwaf38x[.]life

Analysis of gwaf38x.life confirms infrastructure consistent with a phishing portal targeting the GET-X brand, as indicated by the page title 'GET-X' and technical indicators. The domain was registered on February 21, 2026, through URL Solutions, Inc., and was taken offline by July 24, 2026, following detection. It resolved to IP 186.2.165.80, hosted under AS59692 (IQWeb FZ-LLC, United Arab Emirates), a network frequently associated with abusive domains. Nameservers ns1.pananames.com through ns4.pananames.com were utilized, a pattern observed in other phishing campaigns leveraging Pananames for DNS management. Technical fingerprinting reveals the use of Node.js, Vue.js, and Nuxt.js frameworks, alongside Amazon Web Services for hosting, suggesting a modern, scalable phishing kit.

The presence of Google Tag Manager and Google Analytics indicates tracking mechanisms, while HSTS and DDoS-Guard imply attempts to appear legitimate and resist takedowns. The SSL certificate was issued by Let's Encrypt (R13), a common choice for malicious domains due to its free and automated issuance. Detection data shows the domain was flagged by 2 of 95 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, further corroborating malicious intent.

While the exact phishing lure (e.g., credential harvesting, payment fraud) remains unconfirmed due to the domain's offline status, the combination of brand impersonation, modern web technologies, and low detection thresholds aligns with known phishing tactics. Defenders should treat this domain as compromised and block all resolutions to 186.2.165.80. Historical DNS logs should be reviewed for connections to gwaf38x.life or its nameservers, and any SSL certificates issued to the domain should be revoked. Given the use of AWS and DDoS-Guard, monitoring for related infrastructure (e.g.