gwcu60x[.]life

This domain, gwcu60x.life, poses a specific brand impersonation threat targeting the cryptocurrency exchange Kraken. The page title, which includes Russian-language references to Getx registration bonuses and a casino site, indicates that the domain is part of a multi-pronged scheme designed to harvest login credentials or lure users into connecting their crypto wallets, ultimately leading to asset theft. The domain's infrastructure and registration details suggest it was set up with malicious intent, exploiting Kraken's reputation to trick users into believing they are on a legitimate platform.

Evidence supporting this assessment includes a VirusTotal detection ratio of 5 out of 95 security vendors flagging the domain as malicious. The domain was registered through URL Solutions, Inc., and its SSL certificate was issued by Let's Encrypt, a common choice for low-cost, quick deployment of malicious sites. The domain appears on 1 security blocklist, specifically PhishDestroy, and its Gridinsoft trust score is 0 out of 100, indicating no trustworthiness. The domain resolves to IP address 91.215.43.30 and is currently offline, likely due to takedown actions.

Users who visited gwcu60x.life should immediately change any passwords or credentials entered on the site, especially those related to Kraken or other crypto platforms. They should also enable two-factor authentication on all accounts, monitor for unauthorized transactions, and scan their devices for malware. If any crypto wallets were connected, users should revoke permissions and transfer assets to new, secure wallets. Reporting the incident to Kraken's security team is also recommended for further investigation.