varybond[.]net

The domain varybond.net was created on 18 July 2025 and is currently taken offline. It was identified as a brand‑impersonation site targeting Kraken, with the page title "KRAKEN — аутсорсинг бухгалтерских услуг без штрафов и стресса" indicating a fraudulent accounting service claim. When active the site returned HTTP 200 and presented a valid Let’s Encrypt R12 certificate. Infrastructure analysis shows the domain resolves to IP 198.18.1.51 and is served from nameservers ns1.armadns.com and ns2.armadns.com, both associated with the registrar PDR Ltd. d/b/a PublicDomainRegistry.com.

The site employed Yandex.Metrika and DDoS‑Guard, suggesting the operators used analytics and DDoS‑mitigation services to obscure traffic. VirusTotal recorded a single detection out of 95 scanning engines, and the domain appears on one external blocklist. Gridinsoft assigned a trust score of 0 / 100, reinforcing its malicious classification. PhishDestroy has also blocked the domain.

The observed evidence points to a crypto‑scam operation that leveraged Kraken’s brand to lure victims. Defenders should add varybond.net and its IP address 198.18.1.51 to block lists, enforce DNS sinkholing, and monitor the armadns name servers for re‑use. Continuous vigilance is advised for new domains registered by the same registrar that reference Kraken or exhibit similar page titles, as the threat actor may attempt to re‑establish the campaign after takedown.