gwev09x[.]life

This domain, gwev09x.life, is flagged as an active brand impersonation threat targeting Kraken, a major cryptocurrency exchange platform. The site mimics legitimate Kraken login and transaction interfaces, designed to harvest user credentials, API keys, and financial details under false pretenses. Analysis of the page title, 'GET-X,' and the domain structure suggests an attempt to deceive users into believing they are interacting with a legitimate Kraken-affiliated service, likely through phishing emails or malicious advertisements directing victims to the fraudulent endpoint. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered through URL Solutions, Inc. and currently resolves to the IP address 186.2.165.80. Detection metrics confirm its elevated risk status: the domain is flagged by 9 out of 95 security vendors on VirusTotal and appears on one security blocklist. Additional technical artifacts include the use of Node.js, Google Cloud, Vue.js, Nuxt.js, Nginx, Amazon Web Services, reCAPTCHA, and HSTS, alongside a Let's Encrypt SSL certificate, which collectively attempt to lend an air of legitimacy to the operation. Users who visited gwev09x.life should immediately revoke any credentials or API keys entered on the site, as these are likely compromised. It is recommended to monitor associated cryptocurrency wallets and financial accounts for unauthorized transactions. Affected individuals should also scan their devices for malware, as phishing sites may deploy additional payloads. Reporting the incident to the targeted brand’s security team and relevant cybersecurity authorities can aid in mitigating further risks. Given the domain’s current offline status, users should remain vigilant for similar impersonation attempts using newly registered domains or altered infrastructure.