shkolik[.]ru

The domain shkolik.ru hosted a site titled "кракен даркнет маркет зеркала" and listed multiple URLs including kra21.cc, kra21.at, kra22.cc, kra22.at, kra23.cc, kra23.at, kra24.cc, kra24.at, kra25.cc, kra25.at, kra26.cc, kra26.cc, kra27.cc, kra27.at, kra28.cc, kra28at, kra29.cc, kr. The site impersonated the brand "kraken" in a scam type classified as impersonation. This posed a threat by presenting itself as a legitimate darknet marketplace mirror, potentially used to deceive users into accessing fraudulent services, leading to credential theft, financial loss, or malware distribution.

Technical evidence from VirusTotal showed 7 detections out of 95 vendors, with flags from ADMINUSLabs, alphaMountain.ai, CyRadar, Forcepoint ThreatSeeker, and Fortinet. The site was listed on 1 blocklist. It was hosted on IP address 193.105.134.30, located in Sweden (SE), under AS42237 (w1n ltd). The registrar was UK-WIN (ASN: 42237). No SSL certificate was present, and nameservers were not found (NS_NOT_FOUND). The domain creation date was not provided in the available data.

The site was reported as DOWN/OFFLINE. GridinSoft trust rating was 0 out of 100, and the DOM risk score was 10. Based on the provided data, the risk level was high due to the impersonation of a known brand, low trust rating, and multiple security vendor flags, despite the site being offline at the time of analysis.