kraken[.]japancar128[.]ru

On July 24 2026 analysts observed that the domain kraken.japancar128.ru is currently taken offline but continues to appear on at least one security blocklist. The domain was registered through the Russian registrar REGRU‑RU on 7 February 2025 and resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd in Sweden. No TLS certificate is presented, indicating that the site served only HTTP content. The authoritative name servers are ns1.regerey.com and ns2.regerey.com. The page title returned by the host reads “Кракен – AT платформа для анализа данных”, a Russian‑language phrase that incorporates the Kraken brand name.

VirusTotal records show that 10 of 95 scanned security vendors flagged the domain as malicious, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. The domain is listed as a “Crypto Scam” and is specifically noted to impersonate the legitimate cryptocurrency exchange Kraken. It has been blocked by the PhishDestroy blocklist and appears on an additional unnamed security blocklist. Evidence confirms that the infrastructure is tied to a Swedish IP address without encryption, and the lack of a valid SSL certificate further reduces trust. The presence of multiple vendor detections and a zero trust score suggests active abuse, likely aimed at harvesting credentials or diverting cryptocurrency transactions.

However, the exact payload, phishing landing page content, and any associated command‑and‑control infrastructure have not been publicly disclosed, leaving the full attack chain uncertain. Defenders should add kraken.japancar128.ru to internal blocklists, enforce DNS sink‑hole or firewall rules to drop traffic to the IP 193.105.134.30, and monitor for any outbound connections that reference the domain’s name servers. Since the site is offline, threat‑intel sharing platforms should be updated with the registration and hosting details to aid correlation with future campaigns.