gwem76x[.]life

Analysis indicates that the domain gwem76x.life is actively flagged as a high-risk phishing site targeting credentials under the page title 'GET-X'. Registered on February 21, 2026, through URL Solutions, Inc., the domain resolves to the IP address 186.2.165.69, hosted by Iqweb LLC in the United Arab Emirates. Infrastructure analysis reveals the use of nameservers ns1.pananames.com through ns4.pananames.com, a pattern commonly observed in phishing campaigns leveraging bulk domain registration services. The domain is currently detected by 2 of 93 security vendors on a widely used scanning platform, with additional blocking by at least one dedicated anti-phishing system. The SSL certificate is classified as R11, a designation often associated with low-trust or automated certificate issuance, further reducing confidence in the domain's legitimacy. Technologies detected on the site include Node.js, Google Cloud, Vue.js, Nuxt.js, Nginx, Amazon Web Services, and reCAPTCHA, suggesting a moderately sophisticated infrastructure that may be used to evade basic detection mechanisms or simulate legitimacy. The HTTP status code 301 indicates a permanent redirect, though the destination remains unconfirmed. The domain appears on one security blocklist as of the report date. While the exact brand or service being impersonated is not explicitly identified in available data, the page title 'GET-X' may imply a focus on credential harvesting or account takeover attempts. Defenders are advised to treat this domain as malicious and implement blocking at the DNS or network level. Further investigation into associated IP ranges, certificate histories, and redirect chains is recommended to identify related infrastructure. Given the active status and high-risk classification, monitoring for new domains registered under the same nameservers or IP space may aid in preemptive mitigation.