gwfe66x[.]top

The domain gwfe66x.top is a phishing site engaged in brand impersonation targeting Kraken, a cryptocurrency exchange. It was designed to deceive users into believing they were interacting with the legitimate Kraken platform, likely to harvest login credentials or other sensitive information. No cryptocurrency drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk to users.

Technical analysis of gwfe66x.top reveals limited detection, with 2 of 95 VirusTotal security vendors flagging the domain, including alphaMountain.ai and Fortinet. The domain was registered through URL SOLUTIONS INC. on April 18, 2025, and resolved to the IP address 186.2.165.80, hosted by IQWeb FZ-LLC in the United Arab Emirates. It appears on one security blocklist, PhishDestroy, and uses an SSL certificate issued by ddos-guard. The observed page title was 'GET-X,' and the domain utilized nameservers ns1.pananames.com through ns4.pananames.com. Gridinsoft assigned the domain a trust score of 0 out of 100, further indicating its malicious nature.

Users who may have interacted with gwfe66x.top should immediately change their Kraken account passwords and enable two-factor authentication if not already active. Monitor account activity for unauthorized transactions or login attempts. Report the phishing domain to Kraken’s security team and consider submitting it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts. If cryptocurrency transactions were attempted, review wallet activity for suspicious approvals and revoke any unauthorized token permissions.