gwfc42x[.]life

The domain gwfc42x.life is a confirmed phishing site engaged in brand impersonation targeting Kraken, a cryptocurrency exchange. It operated as a cryptocurrency scam designed to deceive users into disclosing login credentials or transferring funds under false pretenses. No drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk to potential victims.

Technical analysis of gwfc42x.life reveals limited detection by security vendors, with 2 of 95 VirusTotal vendors flagging the domain, including Fortinet and Gridinsoft, which assigned a trust score of 0/100. The domain was registered through URL Solutions, Inc., though the creation date is not available. It resolved to the IP address 91.215.43.30, hosted by AS57724 DDOS-GUARD LTD in Russia, and used an SSL certificate issued by ddos-guard. The page title observed was 'gwfc42x.life', and the domain appeared on one security blocklist, PhishDestroy. Google Safe Browsing did not flag the site at the time of assessment.

Individuals who interacted with gwfc42x.life should immediately change their Kraken account passwords and enable two-factor authentication if not already active. Monitor account activity for unauthorized transactions or login attempts. Victims should also report the incident to Kraken’s official support channels and consider filing a complaint with local cybercrime authorities or platforms like the FBI’s IC3 or Action Fraud. Revoking any token approvals granted during the suspected compromise is recommended for added security.