gwae65x[.]life

The domain gwae65x.life is actively hosting a site that claims to be associated with the Kraken brand, as indicated by the explicit impersonation flag. The site responds with HTTP status 200 and presents the page title "GET-X," which aligns with the known intelligence. The domain remains operational and has been identified by security tooling as a high‑risk brand‑impersonation threat.

Infrastructure analysis shows the domain resolves to the IP address 91.215.43.30, which is geolocated to Russia and belongs to AS57724, operated by DDoS‑Guard Ltd. The hosting environment utilizes Amazon Web Services and Amazon CloudFront, with additional layers of protection from DDoS‑Guard and HTTP Strict Transport Security (HSTS). Application‑level technology fingerprints include Node.js, Vue.js, and Nuxt.js, suggesting a modern JavaScript‑based stack.

Threat indicators reinforce the malicious nature of the site. The domain is listed on one security blocklist and has been blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, and VirusTotal reports that 2 out of 95 security vendors have flagged the domain as malicious. The site employs a Let's Encrypt R12 certificate, which provides encryption but does not mitigate the impersonation risk. Registration was performed through URL Solutions, Inc., a registrar often associated with disposable or low‑reputation domains.

Defenders should prioritize immediate containment of traffic to gwae65x.life, adding the domain to network and endpoint blocklists. Continuous monitoring of DNS queries for the associated IP and related AS should be instituted to detect any pivoting activity. Given the cryptocurrency scam classification, security teams should also alert users of Kraken about potential credential harvesting attempts and reinforce multi‑factor authentication controls. Incident response playbooks should be updated to include this indicator set for rapid triage of similar brand‑impersonation campaigns.