gwdz20x[.]life

The domain gwdz20x.life has been identified as a phishing site specifically designed to impersonate Kraken, a major cryptocurrency exchange platform. This domain poses a direct threat of credential theft, unauthorized account access, and fraudulent financial transactions by mimicking legitimate Kraken services. Current analysis confirms the domain is offline, but prior activity indicates a targeted campaign against cryptocurrency users. Infrastructure analysis reveals the domain was flagged by 6 of 95 security vendors on VirusTotal, indicating moderate detection but persistent risk. It resolved to the IP address 91.215.43.30, a host with known associations to malicious activity. The domain was registered through URL Solutions, Inc., a registrar frequently linked to high-risk domains. Additional technical indicators include a Gridinsoft trust score of 0/100 and presence on one security blocklist, specifically PhishDestroy. The SSL certificate issued by Let's Encrypt provided a false sense of security, as automated certificates are commonly exploited in phishing operations. As of the latest assessment, gwdz20x.life is offline, reducing immediate exposure. However, the infrastructure and registration patterns suggest potential for reactivation or migration to similar domains. Organizations and users are advised to block the domain and its associated IP at the network level. Cryptocurrency platforms should monitor for credential reuse from compromised accounts and implement multi-factor authentication enforcement. Security teams should correlate this domain with other Kraken-themed phishing campaigns, particularly those using dynamic subdomains or Let's Encrypt certificates. Proactive threat hunting for related infrastructure, such as domains registered via URL Solutions, Inc., is recommended to preempt future attacks.