gwel81x[.]life

This domain, gwel81x.life, is identified as a brand impersonation threat targeting Kraken, a major cryptocurrency exchange platform. Analysis indicates the site was designed to harvest user credentials and sensitive financial information through a fraudulent interface mimicking legitimate Kraken services. The page title 'GET-X' and detected technologies, including Node.js, Vue.js, and Nuxt.js, suggest the use of a modular front-end framework commonly employed in phishing campaigns to replicate authentic user experiences while evading detection. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 91.215.43.30 and is registered through URL Solutions, Inc. It holds a VirusTotal detection score of 10/95, with security vendors flagging it for malicious activity. The domain appears on one security blocklist and is associated with an SSL certificate issued by Let's Encrypt, a common tactic to lend false legitimacy. Additional protective measures such as HSTS and DDoS-Guard were detected, which may have been implemented to obscure malicious traffic patterns and prolong the campaign's operational lifespan. Currently, gwel81x.life is offline, reducing immediate risk to end users. However, the domain's infrastructure remains intact, and the threat actor could reactivate it or repurpose the same technical stack for future attacks. The presence of a low Gridinsoft trust score of 0/100 further underscores the domain's high-risk classification. Organizations and users are advised to monitor for similar domains registered under the same registrar and to implement network-level blocking for the identified IP address. Continuous vigilance and real-time threat intelligence integration are recommended to mitigate residual risks associated with this campaign.