gwae32x[.]life

This domain, gwae32x.life, is flagged for brand impersonation targeting Kraken, a cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they are interacting with the legitimate Kraken interface, likely to harvest login credentials, API keys, or facilitate unauthorized fund transfers. The page title 'GET-X' further suggests an attempt to mimic Kraken's branding, potentially leveraging typosquatting or social engineering tactics to increase credibility. Technical indicators reveal the domain resolves to the IP address 186.2.165.80 and was registered through URL Solutions, Inc. Detection engines on VirusTotal flagged the domain as malicious, with 9 out of 95 security vendors marking it as a threat. The domain employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. Infrastructure analysis reveals the use of Node.js, Vue.js, Nuxt.js, Amazon Web Services, and DDoS-Guard, indicating a sophisticated setup likely intended to evade detection and maintain uptime. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, reinforcing its malicious classification. As of the latest assessment, gwae32x.life has been taken offline, reducing immediate risk to users. However, the infrastructure and registration details suggest the operators may re-deploy similar domains or shift to alternative IPs. Users who interacted with this domain are advised to rotate credentials immediately, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate potential lateral movement or data exfiltration linked to this campaign.