gwdv96x[.]space

Analysis of the domain gwdv96x.space shows it was registered on February 21 2026 and is currently listed as offline. The DNS resolves to IP 91.215.43.30, which belongs to the Russian autonomous system AS57724 operated by DDOS‑GUARD LTD, placing the hosting infrastructure in Russia. The SSL certificate presented for the site is rated R10, indicating a low‑trust or self‑signed issuance. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, and the domain appears on a single security blocklist.

PhishDestroy has also added the domain to its blocklist. VirusTotal scanning recorded a single positive detection out of 93 scanners, confirming that at least one security vendor identified malicious activity. The domain is flagged for brand impersonation of Kraken and is associated with a crypto‑scam classification.

No further details such as page title, HTTP status codes, or additional sandbox analysis are available, leaving the exact payload or phishing flow unknown. Defenders should block connections to 91.215.43.30 at the network perimeter, add gwdv96x.space to domain‑based deny lists, and monitor for any traffic patterns that reference Kraken‑related login endpoints. Because the site is already offline, remediation focus should shift to preventing reuse of the same infrastructure for future campaigns and to informing users of potential credential harvesting attempts tied to the Kraken brand.