gweh54x[.]life

Analysis of gweh54x.life indicates a high-risk phishing domain targeting credentials associated with the GET-X page title. The domain was registered on February 21, 2026, through URL Solutions, Inc., and remains active as of July 12, 2026. It resolves to IP address 186.2.165.69, hosted under Iqweb LLC in the United Arab Emirates. Nameservers are configured to ns1.pananames.com, ns2.pananames.com, ns3.pananames.com, and ns4.pananames.com, a pattern commonly observed in domains used for phishing campaigns. Infrastructure analysis reveals the use of Node.js, Vue.js, Nuxt.js, Nginx, and Amazon Web Services, alongside Google Cloud and reCAPTCHA, suggesting a modern, potentially automated phishing kit. The domain enforces HSTS, which may be leveraged to appear legitimate while intercepting credentials. A 301 HTTP redirect is present, which could be used to funnel victims to a secondary malicious endpoint. The domain appears on one security blocklist, and one of 93 security vendors on VirusTotal flags it as malicious. The SSL certificate is classified as R11, and the domain holds a Gridinsoft trust score of 0/100, further indicating high risk. No specific brand impersonation is confirmed beyond the GET-X page title, and the exact phishing mechanism remains unanalyzed due to lack of direct website inspection. Defenders should treat gweh54x.life as an active threat. Immediate actions include blocking the domain and its resolving IP (186.2.165.69) at the perimeter, monitoring for internal connections to the domain, and reviewing logs for any prior interactions. If GET-X relates to a known internal or third-party service, users should be alerted to potential credential theft attempts. Further investigation into the phishing kit and associated infrastructure is recommended to identify linked campaigns.