gwci39x[.]top

Analysis of the domain gwci39x.top indicates a brand-impersonation campaign targeting Kraken, a cryptocurrency exchange. The domain was registered on February 21, 2026, and resolved to the IP address 91.215.43.30, hosted by AS57724 (DDOS-GUARD LTD) in Russia. Infrastructure analysis reveals a low-reputation hosting provider frequently associated with malicious activity. The domain was flagged by one security blocklist, PhishDestroy, and received a Gridinsoft trust score of 0 out of 100, suggesting high suspicion.

Three of 95 security vendors on VirusTotal detected the domain as malicious, though the exact nature of the detections remains unverified. The SSL certificate, identified as R10, does not provide additional trust indicators. The domain was classified as a crypto scam and was taken offline by July 24, 2026. No further details regarding the phishing kit, page content, or specific user interaction mechanisms are available.

Defenders should treat this domain as a confirmed threat vector for Kraken impersonation and monitor for related infrastructure, particularly domains resolving to the same IP or ASN. Given the hosting provider's history, additional malicious domains may emerge from the same network. Organizations are advised to block the domain and IP at perimeter defenses and review logs for prior connections. The absence of widespread detection does not indicate safety; limited visibility may reflect delayed reporting rather than low risk.