kraken[.]krab2--cc[.]ru

This domain, kraken.krab2--cc.ru, is identified as a brand impersonation threat targeting the Kraken cryptocurrency exchange. Analysis indicates the site mimics legitimate Kraken branding to deceive users into disclosing sensitive credentials, likely for financial fraud or unauthorized account access. The page title, "Кракен krab2 - разработка AT-программного обеспечения под ключ," suggests an attempt to obscure malicious intent under the guise of software development services, a common tactic in phishing campaigns. Infrastructure analysis reveals the domain was registered through REGRU-RU on December 20, 2025, and resolves to the IP address 91.236.116.210, hosted under AS42237 (w1n ltd) in Sweden. Detection metrics indicate elevated risk: the domain appears on three security blocklists, and VirusTotal reports 9 detections out of 95 security vendors. No SSL certificate is present, further reducing user protection. The domain is currently blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. As of the latest assessment, kraken.krab2--cc.ru has been taken offline, mitigating immediate user exposure. However, residual risk persists due to the domain's recent registration and prior malicious activity. Organizations are advised to monitor for related infrastructure, such as shared IPs or registrant details, and update blocklists to prevent re-emergence. Users should verify domain authenticity before interacting with cryptocurrency platforms and report suspicious activity to relevant security teams.