kraken3yvbvzmhytnrnuhsy772i6dfobofu652e27f5hx6y5cpj7rgydkrab1[.]ru

The domain kraken3yvbvzmhytnrnuhsy772i6dfobofu652e27f5hx6y5cpj7rgydkrab1.ru was registered on December 11, 2025 through RU-CENTER-RU and is currently taken offline. It is configured to use the Cloudflare nameservers elliot.ns.cloudflare.com and liz.ns.cloudflare.com, and DNS resolution points to IP address 104.21.73.31, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented for the host, and the Gridinsoft trust score is recorded as 0 out of 100, indicating a lack of perceived legitimacy. Google Safe Browsing classifies the domain under social engineering, and VirusTotal reports that 15 of 95 security vendors have flagged the host as malicious.

The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. The page title observed during scanning references an associated .onion address (kraken3yvbvzmhytnrnuhsy772i6dfobofu652e27f5hx6y5cpj7rgyd.onion), reinforcing the link to a crypto‑focused scam. The threat is identified as a high‑risk brand impersonation targeting Kraken, with the scam type categorized as a crypto scam.

While the domain is offline, the infrastructure—particularly the use of Cloudflare’s edge network and the absence of encryption—suggests an attempt to obscure the origin of malicious activity. Defenders should continue to block the IP range associated with the domain, monitor for any resurgence of the host, and ensure that endpoint protection solutions are updated to reflect the 15 vendor detections. Additional vigilance is advised for any traffic attempting to resolve to the same IP or to similar subdomains that mimic Kraken branding, as the lack of a valid SSL certificate and the low trust score are indicative of a broader impersonation campaign.