lider2992101[.]ru

Analysis of the domain lider2992101.ru shows an active infrastructure that impersonates the cryptocurrency exchange Kraken. The domain was registered on June 19, 2025 through the TIMEWEB-RU registrar and resolves to the IP address 186.2.175.37, which is announced by AS59692 IQWeb FZ-LLC and geolocated to Belarus. No SSL certificate is presented, meaning the site is reachable only over HTTP, a common characteristic of malicious drop sites. The page title returned by the server is "Kraken krab2 - лидер в производстве промышленного оборудования", which references industrial equipment rather than the Kraken brand, suggesting a content mismatch intended to evade casual inspection while still leveraging the Kraken name. The domain appears on a single security blocklist and has been flagged by PhishDestroy as a phishing source.

Gridinsoft assigns a trust score of 0 out of 100, indicating extreme malicious confidence. VirusTotal reports that 5 of 93 security vendors have flagged the domain, confirming that multiple independent scanners consider it suspicious. The nameservers are carl.ns.cloudflare.com and colette.ns.cloudflare.com, both hosted on Cloudflare, a pattern often used to provide fast DNS resolution while obscuring the true hosting provider. The observable threat type is a crypto scam that targets Kraken users, likely aiming to harvest credentials or lure victims into fraudulent financial transactions.

Defenders should immediately block both the domain and its resolving IP at perimeter firewalls, DNS resolvers, and proxy filters. Adding the domain to internal threat intelligence feeds and updating intrusion detection signatures to match the observed host header and page title can help catch residual traffic. Continuous monitoring of traffic to the Cloudflare nameservers and the Belarus‑based IP range is advised, as well as periodic re‑scans of the site for any changes in payload or hosting.