kraken[.]teplo-balcon[.]ru

The domain kraken.teplo-balcon.ru is a confirmed phishing site engaged in brand impersonation targeting Kraken, a well-known cryptocurrency platform. It poses an elevated risk as a cryptocurrency scam, designed to deceive users into disclosing sensitive information or transferring funds under false pretenses. As of the latest verification, kraken.teplo-balcon.ru has been taken offline, though it previously operated without a drainer kit.

Technical analysis reveals that kraken.teplo-balcon.ru was flagged by 3 of 95 security vendors on VirusTotal, including ChainPatrol, SOCRadar, and Webroot. Google Safe Browsing classified it under 'SOCIAL_ENGINEERING' for phishing activity. The domain appears on one security blocklist, PhishDestroy, and was registered through REGRU-RU on March 02, 2025. It resolved to the IP address 193.105.134.30, hosted by AS42237 (w1n ltd) in Sweden, with no SSL certificate issued. The observed page title was 'Кракен - маркетплейс AT для быстрых покупок', and the nameservers were ns1.regerey.com and ns2.regerey.com. Gridinsoft assigned it a trust score of 0/100.

Users who interacted with kraken.teplo-balcon.ru should immediately change any passwords or credentials entered on the site, enable two-factor authentication (2FA) on all accounts, and monitor for unauthorized transactions or fraudulent activity. Cryptocurrency users are advised to revoke any token approvals associated with the domain and consider transferring funds to a new wallet for added security. The incident should be reported to Kraken’s official support team, as well as to relevant authorities such as the Anti-Phishing Working Group (APWG) or local cybercrime units.