gwdf54x[.]life

This domain, gwdf54x.life, is flagged as an active credential phishing site based on infrastructure analysis and confirmed threat intelligence. Registered on February 21, 2026, through a privacy-protected registrar, the domain remains operational with a 200 HTTP status, indicating an accessible web server. Infrastructure reveals the use of Node.js, Vue.js, Nuxt.js, and Nginx, alongside hosting on Google Cloud and Amazon Web Services, suggesting a modern, multi-layered deployment designed to evade detection. The presence of HSTS and reCAPTCHA may be employed to lend an appearance of legitimacy or to filter automated security scans. The SSL certificate (R12) is valid but does not mitigate the domain's malicious classification. The page title 'GET-X' offers limited insight into the specific target or brand impersonation, though the domain is explicitly categorized as generic phishing. Security vendors have flagged the domain, with five out of ninety-three engines detecting malicious activity at the time of assessment. The domain appears on at least one security blocklist, and its trust score is 0/100, reinforcing its high-risk status. Nameservers are hosted under pananames.com, a provider frequently associated with abusive domains. While the exact phishing kit or targeted brand remains unconfirmed, the combination of modern web technologies, cloud hosting, and active blocklist presence aligns with credential harvesting campaigns. Defenders should treat this domain as hostile and implement immediate blocking at the DNS or network layer. Further analysis of associated IP ranges and historical WHOIS data may reveal additional linked infrastructure. No evidence suggests takedown efforts have succeeded as of July 12, 2026.