gwco96x[.]life

Analysis of the domain gwco96x.life, registered on 21 February 2026 through URL Solutions, Inc., indicates an active brand‑impersonation campaign targeting Kraken. The site resolves to the IP address 91.215.43.30, which is geolocated to Russia and associated with the DDoS‑guard LTD hosting provider. The domain’s authoritative name servers are ns1.pananames.com through ns4.pananames.com, a common configuration for fast‑flux or disposable hosting. The TLS certificate was rated R10, suggesting a low‑trust or self‑signed certificate. The only visible page title, “Гетикс официальный сайт – скачать приложение - регистрация в пару кликов на get‑,” is unrelated to Kraken and appears to be a generic gambling‑oriented landing page likely generated by the “Gambler Scam” phishing kit identified in the intelligence.

VirusTotal scans show that 2 of 93 anti‑malware engines flagged the domain, providing limited but notable detection coverage. The domain is listed on one external blocklist and has been explicitly blocked by the PhishDestroy feed, corroborating its malicious intent. Gridinsoft assigns a trust score of 0 / 100, reinforcing the classification as unsafe. The overall risk is elevated, although the site is currently offline, which may indicate a short‑lived campaign or a takedown.

Defenders should prioritize adding 91.215.43.30 and the associated name‑server set to network‑level deny lists, and monitor for any resurgence of the domain or look‑alike registrations that reuse the same registrar or hosting infrastructure. Email security gateways should be updated to block URLs containing “gwco96x.life” and to flag any messages referencing Kraken that include the observed page title or similar Russian‑language content. Threat‑intel platforms should correlate future Kraken‑related phishing incidents with this infrastructure to improve attribution.