gwbt39x[.]space

gwbt39x.space was registered on 21 February 2026. The domain is associated with a crypto‑scam campaign that claims to represent the Kraken cryptocurrency exchange, as indicated by the “Impersonates: kraken” tag. The site employed an SSL certificate identified as R11, which is typical of low‑quality or self‑signed certificates, and received a Gridinsoft trust score of 0 out of 100, confirming a lack of legitimate reputation. VirusTotal analysis recorded detections from 2 of 93 scanning engines, demonstrating that a minority of security products identified malicious behavior, while the remaining vendors reported no issues.

The domain is presently taken offline and has been listed by the PhishDestroy blocklist and at least one additional security blocklist, reinforcing its classification as hostile infrastructure. Publicly available intelligence does not include the hosting IP, autonomous system number, or country of registration, and no page title or content snapshot has been published. Consequently, the exact delivery mechanism, payload type, and any credential‑harvesting forms remain unknown. The limited detection coverage suggests that the campaign may rely on techniques that evade many scanners, or that the site was quickly seized before broader analysis could be performed.

Defenders should immediately add gwbt39x.space to URL filtering and DNS block policies, enforce strict outbound controls to prevent connections to newly registered domains with low trust scores, and monitor threat‑intel feeds for re‑registration attempts. Given the brand‑impersonation focus, organizations that use Kraken services should alert users to unsolicited communications referencing this domain and advise verification through official Kraken channels. Ongoing collection of hosting data and rapid sharing of any new indicators will improve detection of related infrastructure.