gwdd05x[.]space

Analysis of gwdd05x.space indicates this domain is a confirmed brand impersonation targeting Kraken, a cryptocurrency exchange. The domain was registered on February 21, 2026, and has since been flagged by one security vendor on VirusTotal out of 93 scanned, with PhishDestroy listing it as blocked. It appears on one security blocklist, reinforcing its classification as a crypto scam. The SSL certificate is classified as R10, a low-trust indicator often associated with malicious infrastructure. Gridinsoft assigns a trust score of 0/100, further corroborating its elevated risk status.

As of July 24, 2026, the domain is offline, though this does not eliminate the potential for future reactivation or reuse of its infrastructure. Defenders should treat this domain as malicious based on available evidence. The combination of brand impersonation, low trust scores, and blocklist inclusion justifies immediate blocking at the DNS or proxy level. No additional details about the exact content or functionality of the site are available, as the domain is not currently resolving.

If reactivated, defenders should prioritize capturing forensic artifacts such as SSL certificates, hosting IP ranges, and any associated subdomains for further analysis. Given the domain's age and offline status, monitoring for re-registration or related domains with similar naming patterns (e.g., gwdd05x followed by other TLDs) is recommended. The lack of broader detection on VirusTotal does not indicate safety; it reflects limited visibility or delayed vendor updates. Infrastructure analysis reveals no hosting or ASN details, so network-based indicators should be derived from historical resolutions if available.