gwbq48x[.]xyz

The domain gwbq48x.xyz was identified as a generic phishing site posing an elevated risk. It did not impersonate any known brand or employ a crypto drainer kit. As of the latest verification, gwbq48x.xyz has been taken offline, but its prior activity targeted users with credential harvesting or other fraudulent schemes.

Technical indicators confirm gwbq48x.xyz was flagged by 2 of 95 VirusTotal security vendors, including alphaMountain.ai and Forcepoint ThreatSeeker. The domain appeared on 1 security blocklist (PhishDestroy) and was registered through ripencc. It resolved to the IP address 91.215.43.30, hosted by AS57724 (DDOS-GUARD LTD) in Russia. No SSL certificate was present, and the observed page title was 'GET-X'. The domain had 1 nameserver configured.

Users who may have interacted with gwbq48x.xyz should immediately change any exposed credentials, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized activity. If financial or crypto assets were involved, revoke any token approvals and consider transferring funds to a new wallet. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in mitigation efforts.