gwbq89x[.]life

The domain gwbq89x.life is currently active and has been identified as a brand‑impersonation site targeting the cryptocurrency exchange Kraken. The only visible attribute is the page title, which repeats the domain name, and no further content has been publicly disclosed. Intelligence indicates the site is being used to lure victims under the guise of Kraken‑related services. Technical infrastructure points to a single IPv4 address, 91.215.43.30, which belongs to the Russian autonomous system AS57724 operated by DDOS‑GUARD LTD. The host presents an SSL certificate issued to “ddos‑guard”, suggesting the use of a shared or automated protection service. HTTP requests receive a 301 redirect response, and the domain lacks publicly listed nameservers. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. Two out of ninety‑five VirusTotal scanners have flagged the site, and it has been explicitly blocked by the PhishDestroy mitigation service. The combination of a zero trust score, redirection behavior, and association with a known brand impersonation campaign elevates the risk to high. Defenders should immediately block gwbq89x.life at the DNS and proxy layers, and add its IP address 91.215.43.30 to firewall deny lists. Ongoing monitoring of traffic to the DDOS‑GUARD network may reveal additional malicious hosts employing the same infrastructure. Incident response teams should also alert end users about the Kraken impersonation attempt and advise them to verify URLs before providing credentials or funds.