life-tut[.]ru

Analysis of the domain life-tut.ru indicates it was actively impersonating the Kraken cryptocurrency exchange platform as of its registration on January 27, 2025. The domain was registered through REGRU-RU, a registrar frequently associated with malicious infrastructure, and resolved to the IP address 193.105.134.30, hosted on AS42237 (w1n ltd) in Sweden. Infrastructure analysis reveals the use of nameservers ns1.regerey.com and ns2.regerey.com, which have been previously linked to other suspicious domains. The page title, partially captured as 'Кракен ссылка тор на сайт - kra26.cc, kra26.cc, kra27.cc, kra27.at, kra28.cc...', explicitly references multiple Kraken-branded domains, suggesting an intent to redirect victims to fraudulent mirror sites.

While the exact content of the page remains unanalyzed, the presence of these references aligns with known brand impersonation tactics targeting cryptocurrency users. The domain was flagged by 14 of 95 security vendors on VirusTotal, though this detection count reflects assessments prior to its takedown. Additionally, it appeared on a single security blocklist, specifically PhishDestroy, and received a trust score of 0/100 from Gridinsoft, further corroborating its malicious classification. No SSL certificate was detected for life-tut.ru, a common omission in low-effort phishing campaigns that may trigger browser warnings and reduce victim conversion rates.

The domain is currently offline, though its prior infrastructure and registrar history suggest potential for reemergence under similar or altered domains. Defenders are advised to monitor for newly registered domains under REGRU-RU or utilizing the same nameserver infrastructure, particularly those resolving to the same IP range or ASN. Network-level blocking of 193.105.134.30 and associated domains referenced in the page title (e.g., kra26.cc, kra27.at) may mitigate residual risk.