gwaa97x[.]top

Analysis of the domain gwaa97x.top indicates it was actively involved in a crypto scam impersonating the Kraken cryptocurrency exchange. The domain was registered on February 21, 2026, through URL Solutions Inc. and is currently offline as of July 22, 2026. Infrastructure analysis reveals it resolved to the IP address 91.215.43.30, hosted by Ddos-guard LTD in Russia. Nameservers for the domain were provided by pananames.com, a pattern observed in other phishing campaigns.

The SSL certificate, classified as R10, is consistent with low-trust or automated issuance often seen in fraudulent operations. The page title 'GET-X' and the presence of the Gambler Scam phishing kit suggest the domain was designed to deceive users into interacting with fraudulent cryptocurrency transactions. While only 2 of 95 security vendors on VirusTotal flagged the domain, it appears on at least one security blocklist and was blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, further supporting its classification as malicious.

No additional details about the exact content or user interaction flow are available, as the site is no longer accessible. Defenders should treat this domain as part of a broader Kraken impersonation campaign. Monitoring for similar domains registered through the same registrar or resolving to the same IP range may help identify related threats. Organizations are advised to block traffic to gwaa97x.top and review logs for prior connections to this infrastructure.