krab1[.]id

The domain krab1.id was registered on 2025-12-09 through PT Beon Intermedia and is configured to use the Cloudflare nameservers dell.ns.cloudflare.com and newt.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:3031::ac43:db78, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site’s HTML title reads "Kraken — официальный даркнет‑маркетплейс, закрытая площадка", explicitly referencing the Kraken brand and suggesting a dark‑net marketplace. According to the provided intelligence, the page is classified as a crypto‑scam and employs brand impersonation of Kraken.

The infrastructure appears on a single security blocklist and is currently listed as blocked by PhishDestroy. VirusTotal analysis shows that three out of ninety‑five security vendors have flagged the domain, indicating partial detection. No SSL certificate is presented, and the HTTPS handshake fails, which is consistent with the reported offline status. The risk level is elevated, and the domain is marked as offline at the time of this report (2026-07-24).

Defenders should add krab1.id to network‑level deny lists, monitor the associated Cloudflare IP for any new activity, and consider the registrar PT Beon Intermedia as a potential source of additional malicious domains. Continuous observation of the Cloudflare ASN for similar impersonation campaigns is recommended, as is reviewing any future DNS changes that could reactivate the domain. The lack of a valid TLS certificate and the limited detection footprint suggest a low‑maturity operation, but the explicit brand targeting and cryptocurrency focus warrant heightened vigilance.