gwar44x[.]life

The domain gwar44x.life is currently active and classified as a high‑risk brand‑impersonation campaign targeting Kraken. The site presents the page title "GET‑X" and is identified as a cryptocurrency‑related scam. Its risk level is high, and the campaign remains operational as of the report date, July 12, 2026. The domain is registered through URL Solutions, Inc., and the SSL certificate is issued by Let’s Encrypt (R13), indicating that the site can serve encrypted traffic.

Infrastructure analysis shows that gwar44x.life resolves to the IP address 186.2.165.80, which is assigned to AS59692 (IQWeb FZ‑LLC) in the United Arab Emirates. The web server responds with an HTTP 301 redirect and employs a stack that includes Node.js, Google Cloud, Vue.js, Nuxt.js, Nginx, Amazon Web Services, reCAPTCHA, and HTTP Strict Transport Security (HSTS). The domain appears on a single security blocklist and has been blocked by PhishDestroy. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, reinforcing the malicious nature of the site.

Detection telemetry indicates that VirusTotal has flagged the domain by 2 of 95 security vendors, a relatively low detection count but consistent with the high‑risk classification. Given the observed infrastructure, the presence of reputable security controls such as reCAPTCHA and HSTS does not mitigate the underlying impersonation intent. Defenders should add gwar44x.life to network and endpoint blocklists, monitor DNS queries for the associated IP address, and consider sink‑holing traffic to this domain. Continuous observation of any changes to the site’s content or additional detection signals is advised, as the current intelligence does not include detailed page content beyond the title "GET‑X".