gwcr20x[.]life

Analysis indicates that the domain gwcr20x.life is actively engaged in brand impersonation targeting Kraken, a cryptocurrency exchange platform. Registered through URL Solutions, Inc., the domain resolves to the IP address 91.215.43.30, which is associated with AS57724 (DDOS-GUARD LTD) and located in Russia. The SSL certificate is issued by DDoS-Guard, a provider frequently observed in malicious infrastructure. The domain currently returns an HTTP 301 redirect status, suggesting it may be part of a larger redirection chain or staging phase for phishing operations. As of July 12, 2026, the domain appears on at least one security blocklist and is flagged by two of 95 security vendors on VirusTotal, confirming its classification as malicious. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. No nameserver information is currently available, which may limit passive DNS analysis. The exact content of the site remains unanalyzed, but the scam type is identified as cryptocurrency-related, consistent with the targeted brand. Defenders should prioritize blocking this domain at the network level, particularly for endpoints accessing cryptocurrency services. Monitoring for connections to 91.215.43.30 or domains registered via URL Solutions, Inc., with similar naming patterns (e.g., random alphanumeric strings) may help identify related campaigns. Given the active status and confirmed detection by security vendors, immediate action is recommended to mitigate potential credential theft or financial fraud.