gwbx37x[.]top

gwbx37x.top is a newly registered domain observed in a brand‑impersonation campaign targeting the cryptocurrency exchange Kraken. The domain was created on 21 February 2026 and registered through URL Solutions Inc. Its authoritative name servers are ns1.pananames.com., ns2.pananames.com., ns3.pananames.com., and ns4.pananame (the fourth entry appears truncated). DNS resolution points to the IP address 91.215.43.30, which is hosted by Ddos‑guard LTD in the Russian Federation. The hosting provider is known for offering DDoS‑mitigation services and has been associated with malicious infrastructure in prior investigations.

A TLS certificate identified as “R10” is present on the site, indicating that HTTPS was enabled at the time of observation. The HTTP response returned a page with the title “GET‑X”, but the site is currently reported as offline, preventing further content analysis. The campaign is attributed to the “Gambler Scam” phishing kit and is classified as a crypto‑scam, consistent with the targeting of Kraken users. VirusTotal analysis recorded detections from 2 of 93 scanning engines, demonstrating that at least a minority of security products flagged the domain as malicious.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. Given the combination of recent registration, use of a reputable DNS provider, hosting on a DDoS‑guard IP, the presence of a TLS certificate, low detection count, and the explicit brand‑impersonation indicators, defenders should treat gwbx37x.top as a high‑confidence malicious indicator.