gwei16x[.]top

This domain, gwei16x.top, is identified as a brand impersonation threat specifically targeting Kraken, a well-known cryptocurrency exchange. Analysis of the page title—'Getx зеркало актуальное - официальный сайт casino - Гет Х бонус за регистрацию'—reveals an attempt to deceive users by mimicking Kraken’s branding while promoting a fraudulent casino mirror site. The inclusion of terms like 'зеркало' (mirror) and 'бонус за регистрацию' (registration bonus) suggests a scheme designed to lure victims into depositing funds or disclosing login credentials under false pretenses. No evidence of a cryptocurrency drainer kit was found in the available data, but the domain’s structure and content align with credential harvesting and financial fraud tactics commonly used in crypto-related scams. Infrastructure analysis reveals several critical technical indicators. The domain was registered on April 29, 2025, through URL SOLUTIONS INC., a registrar frequently associated with high-risk domains. It resolves to the IP address 91.215.43.30, which has been linked to other fraudulent activities in the past. VirusTotal reports that 4 out of 95 security vendors flag gwei16x.top as malicious, indicating a moderate but concerning level of detection. The domain appears on one security blocklist and is blocked by PhishDestroy, further corroborating its fraudulent nature. Gridinsoft assigns it a trust score of 0/100, reinforcing its classification as a high-risk entity. No listings were found in Google Safe Browsing at the time of analysis, though this does not diminish the domain’s overall risk profile. As of the latest assessment, gwei16x.top is offline, reducing its immediate threat to end users. However, the domain’s infrastructure remains intact, and there is a residual risk of reactivation or repurposing for future fraudulent campaigns. Users who may have interacted with the site are advised to monitor their accounts for unauthorized transactions, reset any credentials shared with the domain, and enable multi-factor authentication on all financial and cryptocurrency platforms. Organizations should consider proactively blocking the domain and its associated IP (91.215.43.30) at the network level to prevent potential future exposure. Given the domain’s recent creation and its association with a known fraudulent registrar, continued vigilance is recommended.