kra-aa-31-at[.]ru

The domain kra-aa-31-at.ru was registered on February 21, 2025 through the REGRU-RU registrar and is currently taken offline. No SSL certificate is presented for the site, indicating that any traffic would occur over unencrypted HTTP. DNS resolution points to the IPv4 address 91.236.116.20, which belongs to AS42237 (w1n ltd) and is geolocated in Sweden.

The authoritative nameservers are ns1.armadns.com and ns2.armadns.com. The page title observed during the brief activity window listed multiple sub‑domains (kra29.cc, kra30.cc, kra31.cc, kra32.cc, kra29.at, kra30.at, kra31.at, kra32.at) prefixed with "Kraken -", confirming a brand‑impersonation attempt targeting the cryptocurrency exchange Kraken. Google Safe Browsing classifies the domain as a social engineering threat, and it appears on a single external blocklist that is actively used by the PhishDestroy service.

VirusTotal analysis shows that 14 of 95 scanning engines flagged the domain, reinforcing the malicious assessment. The threat is categorized as a Crypto Scam, consistent with the impersonated brand and the observed page title. While the site is no longer reachable, defenders should continue to block the domain and its associated IP, monitor for any re‑use of the same registrar or nameserver configuration, and update detection rules to capture the observed page‑title pattern and the specific host fingerprint.