gwen29x[.]lol

The domain gwen29x.lol is a phishing site engaged in brand impersonation targeting Kraken, a cryptocurrency exchange. It poses an elevated risk by attempting to deceive users into entering login credentials or sensitive information under the false pretense of being the legitimate Kraken platform. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate exposure but not eliminating prior compromise risks for visitors.

Technical analysis shows gwen29x.lol was flagged by 2 of 95 VirusTotal security vendors, including Gridinsoft and Trustwave, with a Gridinsoft trust score of 0/100. The domain appears on 1 security blocklist (PhishDestroy) and is registered through ripencc. It resolves to the IP address 91.215.43.30, hosted by AS57724 (DDOS-GUARD LTD) in Russia. No SSL certificate was observed, and the page title displayed was 'GET-X'. The domain uses a single nameserver, and no creation date is available.

Users who interacted with gwen29x.lol should immediately change their Kraken account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized transactions or login attempts. Report the phishing domain to Kraken’s security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.