krab2-cc[.]ru

krab2-cc.ru was registered on 16 December 2025 through the RU‑CENTER‑RU registrar. The domain resolves to 172.67.213.6, an address owned by AS13335 Cloudflare, Inc., with the IP geolocated to the United States. Both authoritative name servers – amos.ns.cloudflare.com and kay.ns.cloudflare.com – are Cloudflare‑provided, indicating the attacker leveraged the provider’s free DNS service to hide infrastructure. No TLS certificate is presented, so the site was reachable only over plain HTTP. The only visible artifact is the HTML title “Kraken новое официальное зеркало krab1 cc и krab1 at”, which explicitly references the Kraken brand and claims to be an official mirror.

This aligns with the classified “Crypto Scam” label and the “Impersonates: Kraken” tag. Google Safe Browsing has flagged the URL for social engineering, and Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. Independent scanning on VirusTotal recorded detections from 2 of 93 antivirus engines, and the domain is listed on a single external blocklist. PhishDestroy also reports the domain as blocked. Because the site is currently offline, active payloads cannot be observed, and the page content beyond the title has not been captured.

Consequently, the exact phishing workflow, credential‑stealing forms, or malicious redirects remain unknown. However, the combination of brand impersonation, low trust scores, and confirmed blocklist entries provides sufficient confidence to treat the domain as a malicious actor targeting Kraken users. Defenders should immediately add krab2-cc.ru to deny‑list rules on perimeter firewalls, DNS filtering services, and secure web gateways. Monitoring for any future re‑registration of the same second‑level domain or similar‑looking variants is advised.