gwax94x[.]life

A comprehensive investigation into the domain gwax94x.life reveals that it is actively engaged in brand impersonation targeting the cryptocurrency exchange Kraken. The domain was detected and flagged due to its high risk of being a phishing site, with a specific focus on defrauding users in the cryptocurrency sector. The site is currently active and has been marked on one security blocklist, indicating a level of awareness and concern within the security community. The HTTP status of 301 suggests that the domain is performing a redirect, potentially to a more sophisticated phishing page or another malicious domain, which further complicates the threat landscape and can obscure the true nature of the site's activities. The SSL certificate for the domain is provided by ddos-guard, a provider known for its use in protecting websites from distributed denial-of-service attacks but also frequently associated with less reputable sites. This association may indicate an attempt by the domain operators to avoid detection or enhance the site's credibility by using a secure connection. The IP address 91.215.43.30, located in Russia and registered under AS57724, raises additional red flags due to the association with a region and ASN commonly linked to cybercriminal activities. The Gridinsoft trust score of 0/100 underscores the highly suspicious nature of the domain, as it indicates a complete lack of trustworthiness based on the available data. Defenders should treat this domain as a high-risk threat and implement immediate blocking measures to protect users from potential financial loss and credential theft. Further analysis of the exact content and redirection paths is recommended to understand the full scope of the threat and the specific tactics used to impersonate Kraken. Defenders should also monitor related domains and IP addresses to identify and mitigate any additional phishing activities linked to this incident.