gwfi25x[.]xyz

The domain gwfi25x.xyz has been identified as a phishing site engaged in brand impersonation, specifically targeting users of the Kraken platform. This domain posed an elevated risk by attempting to deceive visitors through fraudulent means, likely aiming to harvest sensitive information or credentials. As of the latest assessment, gwfi25x.xyz has been taken offline and is no longer accessible.

Technical analysis shows that gwfi25x.xyz was detected by 2 of 95 security vendors on VirusTotal, specifically alphaMountain.ai and Forcepoint ThreatSeeker. It is registered through ripencc and resolves to the IP address 91.215.43.30, which is located in Russia under AS57724 DDOS-GUARD LTD. The domain appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100. The observed page title was GET-X. No SSL certificate was present, and only one nameserver was associated with the domain.

Anyone who interacted with gwfi25x.xyz, especially those who entered Kraken credentials, should immediately change their passwords, enable two-factor authentication, and closely monitor their accounts for unauthorized activity. It is also advisable to report any fraudulent activity associated with this phishing domain to the impersonated brand (Kraken) and relevant cybersecurity authorities to help prevent further incidents.