gwbt52x[.]space

This domain is currently offline, but historical data indicate it was used for a brand‑impersonation campaign targeting Kraken. The domain gwbt52x.space was registered on 21 February 2026. Within weeks it appeared on at least one security blocklist; PhishDestroy has listed it as malicious. VirusTotal records show that one out of ninety‑three scanning engines flagged the domain, confirming at least a minimal detection rate.

The Gridinsoft trust score is 0 / 100, reflecting a complete lack of trust. The SSL certificate is rated R10, which suggests a low‑trust or self‑signed certificate typically associated with fraudulent sites. The campaign is classified as a crypto scam, and the brand target is explicitly identified as Kraken, indicating that any malicious pages likely attempted to lure cryptocurrency users with fraudulent Kraken‑related content. Because the site is offline, active probing is not possible, and no HTTP response headers, page titles, or content snapshots are available for deeper analysis.

The limited visibility means that the full infrastructure—such as hosting provider, IP address, ASN, or geographic location—remains unknown. Defenders should continue to block the domain at the DNS and proxy layers, monitor for any re‑registration attempts, and incorporate the indicator into threat‑intel feeds. Security teams should also review outbound traffic for connections to the domain’s resolved IPs prior to takedown, and consider adding the domain to internal blacklists for any future use. Ongoing vigilance is advised, especially for users of Kraken services, to prevent credential harvesting or crypto‑drain attempts that may be launched from similarly crafted impersonation sites.