portal[.]kraken19at-t[.]ru

Analysis of portal.kraken19at-t.ru shows a newly created (02 Dec 2025) domain registered through REGRU‑RU and hosted on nameservers ns1.hosting.reg.ru and ns2.hosting.reg.ru. The domain resolves to IP 31.31.196.214, which belongs to AS197695 owned by REG.RU and is geolocated in Russia. No SSL certificate is presented, indicating that the site was served only over HTTP.

The page title captured from the site, "Торговый портал – Kraken Marketplace," directly references the Kraken brand, confirming a brand‑impersonation tactic aimed at cryptocurrency users. VirusTotal scans have flagged the domain by nine of ninety‑five security vendors, and the domain appears on a single public blocklist. PhishDestroy has already taken the site offline and added it to its blocklist.

While the site is no longer reachable, the infrastructure—registrar, hosting IP, and lack of TLS—matches patterns observed in other crypto‑related impersonation campaigns. Defenders should continue to block the domain at network perimeter, update URL filtering rules to include the observed IP range, and monitor for future registrations that reuse the same registrar or nameserver configuration. Observers should also watch for replicas that may employ HTTPS or different subdomains while retaining the same brand‑targeted page title, as these could indicate a re‑deployment of the same campaign infrastructure.