gunwest[.]biz

gunwest.biz has been identified as a generic phishing domain, currently taken offline. This threat type encompasses various credential theft and data harvesting schemes, though no specific brand was impersonated in this case. The domain was created on February 24, 2026, and registered through NiceNIC International Group Co., Limited, a registrar often associated with questionable domains. It resolves to IP address 172.67.191.220 and utilizes a Let's Encrypt SSL certificate (E7), which is common among both legitimate and malicious sites.

VirusTotal data shows that 4 out of 95 security vendors flagged gunwest.biz as malicious, indicating a moderate but concerning detection rate. The domain also appears on one security blocklist, further corroborating its malicious nature. Despite these indicators, the domain's trust scores and reputation metrics from various sources remain mixed, which is typical for newly created phishing domains. The page title was observed as "Все товары - Мой сайт" (Russian for "All products - My site"), suggesting a possible e-commerce facade to lure victims.

As the domain is now offline, users are no longer at immediate risk from this specific site. However, PhishDestroy recommends that users remain vigilant against similar domains registered through NiceNIC and avoid entering credentials or personal information on unfamiliar sites. Always verify the legitimacy of websites before interacting, and consider using security tools that block known phishing domains. If you have previously visited gunwest.biz, change any passwords used on that site immediately and monitor accounts for suspicious activity.