gwft46x[.]life

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Kraken, a major cryptocurrency exchange. Analysis indicates the site was designed to deceive users into entering login credentials, which would likely be harvested for unauthorized account access or subsequent crypto asset theft. The infrastructure and content closely mimic legitimate Kraken authentication portals, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain gwft46x.life was registered through URL Solutions, Inc. and resolved to the IP address 186.2.165.80. The domain is secured with a Let's Encrypt SSL certificate, a common tactic to lend false legitimacy to malicious sites. Detection metrics show 5 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on at least one security blocklist and is currently offline, though this status may change. The page title, gwft46x.life, matches the domain name, a pattern often observed in credential harvesting pages lacking branded content. To mitigate risks associated with this brand impersonation threat, users should verify domain authenticity before entering credentials on any cryptocurrency platform. Enable multi-factor authentication (MFA) on all exchange accounts to prevent unauthorized access even if credentials are compromised. Security teams should block the domain gwft46x.life and its resolving IP 186.2.165.80 at the network level. Organizations are advised to monitor for similar domains registered through URL Solutions, Inc. or resolving to the same IP range, as these may indicate related malicious infrastructure. Users who entered credentials on this site should immediately change passwords and review account activity for unauthorized transactions.