gwcf43x[.]top

The domain gwcf43x.top is a phishing site engaged in brand impersonation, specifically targeting users of the Camelot platform. It does not deploy a crypto drainer kit but instead aims to harvest login credentials or other sensitive information through deceptive means. As of the latest verification, gwcf43x.top has been taken offline, though its prior activity poses residual risks to users who may have interacted with it.

Technical indicators confirm the domain's malicious nature. gwcf43x.top was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft (which assigned a trust score of 0/100) and Trustwave. It appears on 1 security blocklist, PhishDestroy, and is registered through the ripencc registrar. The domain resolves to the IP address 91.215.43.30, hosted by AS57724 (DDOS-GUARD LTD) in Russia, with a single nameserver configured. No SSL certificate was observed, and the page title was absent during analysis.

Users who visited gwcf43x.top should immediately change any passwords or credentials entered on the site, particularly for Camelot-related accounts. Enable two-factor authentication (2FA) on all affected services to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts. To report the domain, submit it to platforms like Google Safe Browsing, PhishTank, or the impersonated brand's security team for further investigation and takedown efforts.