kraken-sait1[.]online

Analysis confirms that the domain kraken-sait1.online was registered on February 21, 2026 through the Russian registrar REGRU-RU and resolves to the IPv4 address 185.105.225.180, which belongs to AS200487 operated by OOO VPS in Russia. The domain is hosted on a server that provides no TLS certificate, indicating that connections are unencrypted. Nameserver records point to ns1.reg.ru and ns2.reg.ru, both typical of Russian‑based registration services. The page title returned from the site, “КРАКЕН: Актуальные ссылки и зеркра маркета”, directly references the Kraken brand and suggests the intent to present current links and mirrors for a market, a pattern commonly used in crypto‑related scams. The intelligence set classifies the activity as a brand‑impersonation crypto scam targeting users of the Kraken exchange.

Reputation checking shows the domain appears on a single security blocklist and has been flagged by PhishDestroy. VirusTotal scans reported three detections out of ninety‑three antivirus engines, confirming that at least a minority of security products recognize the domain as malicious. No Safe Browsing verdict is provided in the supplied data, and the site is currently offline, limiting immediate observation of content. The lack of an SSL certificate and the use of a Russian IP address are consistent with previously observed infrastructure used in cryptocurrency phishing campaigns.

Uncertainties remain regarding the exact content delivered to victims, the specific phishing kit employed, and whether any credential‑stealing forms were hosted before the takedown. Defensive teams should continue to block the domain at network perimeter devices, add the IP address 185.105.225.180 to deny‑list rules, and monitor for additional domains that resolve to the same nameservers or ASN.