gwci22x[.]life

Analysis of the domain gwci22x.life indicates active credential phishing infrastructure as of July 12, 2026. The domain resolves to IP address 91.215.43.30, which is hosted on AS57724 (DDOS-GUARD LTD) and geolocated in Russia. Infrastructure analysis reveals the use of a DDoS protection provider for its SSL certificate, a common tactic to obscure hosting origins and evade takedowns. The domain was registered through URL Solutions, Inc., though no nameserver details are currently available. The site returns an HTTP 301 redirect, suggesting it may be part of a multi-stage phishing chain rather than a standalone landing page. The page title 'Privacy error' is consistent with domains attempting to bypass browser security warnings or simulate technical issues to lower user suspicion. While only 2 of 95 security vendors on VirusTotal currently flag the domain, this low detection rate may reflect limited visibility rather than benign intent, particularly given its presence on at least one security blocklist. Defenders should note that the domain remains active and has not been widely classified, which may indicate a targeted or recently deployed campaign. The lack of additional context—such as a confirmed brand target or phishing kit—limits further classification, though the infrastructure aligns with known phishing patterns. Network-level blocking of 91.215.43.30 and monitoring for related domains registered under the same registrar are recommended mitigation steps. Organizations should treat this domain as high-risk until further analysis confirms its removal or reclassification.