gwfz50x[.]life

The domain gwfz50x.life was a phishing site engaged in brand impersonation targeting Kraken, a cryptocurrency exchange. It posed an elevated risk as a cryptocurrency scam, attempting to deceive users into disclosing sensitive information or transferring funds under false pretenses. The site is currently taken offline, and no drainer kit was identified in this campaign.

Technical analysis of gwfz50x.life revealed limited detection, with 1 of 95 VirusTotal security vendors flagging the domain. The registrar was URL Solutions, Inc., though the creation date was not available. The domain resolved to the IP address 186.2.165.80, hosted under AS59692 (IQWeb FZ-LLC) in the United Arab Emirates. It appeared on 1 security blocklist (PhishDestroy) and was not flagged by Google Safe Browsing. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Getx casino зеркало - бонус код игрока - Гет Х играть на деньги'. Detected technologies included Yandex.Metrika, Cloudflare Browser Insights, Cloudflare, and HTTP/3. Gridinsoft assigned a trust score of 0/100 to the domain.

Users who interacted with gwfz50x.life should immediately change any passwords associated with Kraken or other cryptocurrency services and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized transactions or suspicious activity. If cryptocurrency was transferred, revoke any token approvals granted to unknown contracts and consider moving remaining funds to a new wallet. Report the phishing domain to Kraken’s security team and submit it to platforms like PhishTank or Google Safe Browsing for broader awareness and mitigation.