kraken-vhod2[.]online

Analysis of kraken-vhod2.online shows a newly registered domain created on February 21, 2026 that was promptly taken offline, indicating a short-lived campaign. The site resolves to IP address 185.105.225.180, which is hosted in Russia and assigned to ASN AS200487 OOO VPS. Registration was performed through the Russian registrar REGRU-RU, and the domain uses the registrar's default nameservers ns1.reg.ru and ns2.reg.ru. No TLS certificate was observed, meaning the site operated without HTTPS protection.

The page title retrieved from the site, "КРАКЕН: Актуальные ссылки и зеркала маркета," references the Kraken brand and aligns with the reported brand impersonation intent. VirusTotal scans recorded three detections out of ninety‑five security vendors, confirming that multiple scanners flagged the domain as malicious. The domain appears on a single public blocklist, PhishDestroy, which has already classified it as a crypto‑related scam. The limited detection surface suggests the infrastructure was deployed quickly and then dismantled, a pattern often seen in fast‑flux or throwaway phishing operations targeting cryptocurrency users.

While the exact payload or credential‑harvesting mechanism remains unknown, the combination of brand impersonation, lack of encryption, and the presence of a Russian‑based VPS host points to a low‑cost, high‑turnover threat model. Defenders should update firewall and DNS filtering rules to block the IP 185.105.225.180 and the domain kraken-vhod2.online, monitor for any reuse of the hosting provider or registrar in future incidents, and enforce multi‑factor authentication on Kraken accounts to mitigate credential compromise. Continuous monitoring of the AS200487 network for similar domains is recommended, as threat actors often recycle infrastructure across campaigns.