gwdn48x[.]top

This domain is flagged as a credential harvesting phishing site with an elevated risk level. Analysis indicates it operates under the page title GET-X, designed to mimic legitimate login portals and capture sensitive user credentials, including usernames, passwords, and potentially multi-factor authentication codes. The infrastructure and content suggest a targeted approach to compromise corporate or financial accounts. Infrastructure analysis reveals multiple high-risk indicators. The domain gwdn48x.top was registered on April 17, 2025, through URL SOLUTIONS INC., a registrar frequently associated with fraudulent domains. It resolves to the IP address 91.215.43.30, which has been linked to prior phishing campaigns. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, indicating no legitimacy. VirusTotal reports that 3 out of 95 security vendors flag this domain as malicious, further corroborating its fraudulent nature. The domain is currently offline, but historical data confirms its use in active phishing operations. Mitigation steps for organizations and users include immediate blocking of the domain gwdn48x.top and its associated IP 91.215.43.30 at the network perimeter. Security teams should conduct retrospective log analysis to identify any prior connections to this domain or IP. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, prioritizing accounts with elevated privileges. Enabling multi-factor authentication on all critical accounts adds an additional layer of protection. Security awareness training should emphasize the risks of credential harvesting portals and the importance of verifying domain legitimacy before entering sensitive information.