gwfy00x[.]life

This domain, gwfy00x.life, is flagged as a high-risk cryptocurrency phishing site. Registered on February 21, 2026, through URL Solutions, Inc., it remains operational as of July 12, 2026. Infrastructure analysis reveals the domain uses four nameservers (ns1.pananames.com through ns4.pananames.com) and presents a 301 HTTP redirect, which is a common tactic to obscure final landing pages or evade detection. The SSL certificate is classified as R10, indicating a low-trust or potentially automated issuance, which aligns with patterns observed in phishing infrastructure. The domain appears on one security blocklist and is detected by 2 out of 95 security vendors on VirusTotal. While this detection rate is relatively low, it does not indicate safety—phishing domains often evade detection during early deployment phases. The Gridinsoft trust score of 0/100 further supports the assessment of malicious intent. No specific brand impersonation or phishing kit has been confirmed, but the domain's structure (gwfy00x) suggests a disposable or algorithmically generated name, a common characteristic of short-lived phishing campaigns. Defenders should treat this domain as active and hostile. The 301 redirect may lead to a credential harvesting page or a fake cryptocurrency wallet interface. Network-level blocking is recommended, particularly for endpoints handling financial or cryptocurrency transactions. Monitoring for related domains using similar naming patterns (e.g., gwfy00x, gwfy01x) may help identify additional threats from the same actor. No evidence currently links this domain to broader malware distribution or command-and-control activity, but continued observation is warranted given its persistence and low detection rates.