gwac37x[.]life

This domain, gwac37x.life, is flagged for brand impersonation targeting Kraken, a major cryptocurrency exchange platform. Analysis indicates the site presented itself as a functional mirror of the legitimate Kraken service, using localized content in Russian with the title 'Гет Х рабочее зеркало на сегодня - официальный сайт - регистрация в Get-x.' The infrastructure appears designed to deceive users into believing they are accessing an official or sanctioned alternative endpoint for Kraken, likely to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 186.2.165.80 and was registered through URL Solutions, Inc. Security vendors on VirusTotal flagged the domain, with 9 out of 95 engines detecting malicious activity. The domain appears on one security blocklist and is associated with technologies including Node.js, Vue.js, Nuxt.js, and Amazon Web Services hosting. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and fraudulent sites. No Google Safe Browsing (GSB) detections were recorded at the time of assessment, though the domain has since been taken offline. Current status shows the domain as offline, likely following detection and mitigation efforts. Despite its inactive state, residual risk remains due to potential reuse of the infrastructure or migration of the threat to another domain. Users who accessed the site should assume credential exposure and take immediate action, including password resets and multi-factor authentication review. Organizations should monitor for related domains using similar naming conventions or infrastructure patterns, particularly those leveraging the same IP range or registrar.