gweo15x[.]top

On 24 July 2026 the domain gweo15x.top was observed as an offline phishing host. The WHOIS record shows the domain was registered on 21 February 2026 through URL Solutions Inc. and is assigned to the Autonomous System AS59692 owned by IQWeb FZ‑LLC in the United Arab Emirates. DNS resolution points to the IPv4 address 186.2.165.80, which is hosted on infrastructure identified as both Google Cloud and Amazon Web Services, suggesting the operator leveraged multi‑cloud resources. The domain is served over HTTPS using a Let’s Encrypt certificate (R12) and HTTP responses include strict‑transport‑security headers, indicating an attempt to appear legitimate. Content analysis, limited to the page title returned by the web server, yields the string “GET‑X”.

No further page markup has been captured because the site is currently offline. Technical fingerprints from passive scans reveal a stack comprising Node.js, Vue.js, Nuxt.js, and Nginx, consistent with modern JavaScript‑driven phishing kits. reCAPTCHA is also present, likely to evade automated analysis. Reputation services provide mixed signals: VirusTotal reports that 2 of 95 scanning engines flagged the domain, and the site appears on one public blocklist. The Gridinsoft trust score is 0 out of 100, and the domain is listed by PhishDestroy as blocked.

The four authoritative nameservers (ns1‑ns4.pananames.com) are typical of low‑cost DNS providers. The available evidence confirms the domain’s use for generic phishing, but the exact target brand or credential‑harvesting template remains unknown due to lack of captured content. Defenders should add gweo15x.top to blocklists at the DNS and proxy layers, monitor the associated IP address for any re‑activation, and treat any future TLS certificates issued for the domain with suspicion. Continuous observation of the registrar’s activity and the hosting AS may reveal further campaigns.