gwbv35x[.]xyz

The domain gwbv35x.xyz was registered on 21 February 2026 and is presently taken offline. DNS resolution points to the IP address 76.223.26.96, which is hosted within the Amazon.com, Inc. network (AS16509) and geolocated to the United States. An SSL certificate identified as R11 is present on the host, indicating that HTTPS connections were available while the site was active. The page title returned by the server matches the domain name exactly, providing no additional contextual clues about the intended victim or lure.

The domain appears on a single security blocklist and has been flagged by the PhishDestroy service, confirming its classification as a generic phishing infrastructure. Reputation scoring from Gridinsoft assigns a zero out of one hundred, reflecting an extremely low trust rating. VirusTotal analysis reports that two of ninety‑three scanned security vendors flagged the domain, reinforcing the suspicion of malicious intent despite the limited detection count. No further intelligence on the phishing kit, targeted brand, or specific payload is available from the current dataset.

The combination of a newly created domain, Amazon‑hosted IP, active TLS certificate, and inclusion on a blocklist suggests a short‑lived phishing campaign that was likely abandoned or seized. Defenders should continue to block the domain and its associated IP address at perimeter defenses, monitor for any re‑use of the IP by unrelated services, and consider adding the host to internal threat‑intel feeds. Ongoing observation of the ASN for new malicious registrations is advisable, as the same hosting provider may be leveraged for future campaigns.