kraken[.]wb-academys[.]ru

This domain is flagged as a high-risk brand impersonation phishing site targeting Kraken, a well-known cryptocurrency exchange. The threat involves deceiving users into believing they are interacting with a legitimate Kraken platform, potentially leading to credential theft, financial fraud, or unauthorized access to sensitive accounts. The page title, "Кракен - AT магазин стильных аксессуаров," suggests an attempt to mimic Kraken’s branding while presenting unrelated content, a common tactic to evade detection and lure victims.

Analysis indicates the domain kraken.wb-academys.ru resolves to IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden. The domain was registered on March 02, 2025, through REGRU-RU and currently lacks an SSL certificate, increasing the risk of data interception. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing classifies it as phishing. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Infrastructure analysis reveals the domain’s recent creation and association with a hosting provider commonly linked to malicious activity.

Mitigation steps for this threat include immediate blocking of the domain and its associated IP address (193.105.134.30) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to this domain. Users should be educated on recognizing brand impersonation tactics, particularly those involving cryptocurrency platforms. Monitoring for similar domains registered through REGRU-RU or resolving to the same IP range is recommended to identify potential follow-up campaigns. If credentials were entered on this site, affected accounts should be secured immediately, and multi-factor authentication should be enforced.