krab2-at2[.]ru

Analysis of the domain krab2-at2.ru indicates an active brand‑impersonation campaign targeting the Kraken brand. The site presents a Russian‑language page title "Кракен сайт магазин: рабочая ссылка и вход онлайн," which aligns with the declared impersonation of Kraken. The domain was registered on February 21, 2026 and is hosted behind Cloudflare, using the nameservers kyree.ns.cloudflare.com and lucy.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, owned by AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS connection, and the server supports HTTP/3. An HTTP request returns status code 200, indicating the site is reachable. Security scoring from Gridinsoft rates the domain at 0/100, and VirusTotal reports that 2 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. While the page content beyond the title has not been publicly analyzed, the combination of a high‑risk rating, brand‑impersonation claim, active hosting, and multiple blocklist entries suggests a credible threat. Defenders should block krab2-at2.ru at network perimeter, add it to endpoint deny lists, and monitor for related infrastructure such as the hosting IP and Cloudflare nameservers. Users should be warned that any login or transaction attempts referencing Kraken on this domain are illegitimate.