sokolov30[.]ru

Analysis of sokolov30.ru as of July 23 2026 indicates that the domain is actively used for brand impersonation targeting the cryptocurrency exchange Kraken. The site is registered through the UK‑WIN registrar (ASN 42237) and resolves to the IP address 193.105.134.30, which is geolocated in Sweden and belongs to AS42237 w1n ltd. No SSL certificate is present, and the domain resolves to Cloudflare name servers roxy.ns.cloudflare.com and titan.ns.cloudflare.com, suggesting the use of Cloudflare’s proxy service.

The page title returned by the server contains a concatenated list of “kraken onion link” entries referencing multiple “kraXX.cc” and “kraXX.at” sub‑domains, reinforcing the intent to mimic Kraken‑related content. VirusTotal scans have flagged the domain on seven of ninety‑five engines, and it appears on a single security blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of malicious intent.

The domain is currently offline, which limits real‑time verification of payloads or redirects, but the existing indicators are sufficient to classify the infrastructure as a crypto‑scam operation. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP and name‑server ranges for any re‑activation, and update threat‑intel feeds with the observed indicators. Additional analysis is required to determine whether the site hosted any malicious binaries or credential‑harvesting forms, as the current evidence is limited to registration, hosting, and reputation data.