captcha-slon7cc[.]ru

Analysis indicates that the domain captcha-slon7cc.ru is actively impersonating the Kraken cryptocurrency exchange as of July 12, 2026. The domain resolves to the IP address 188.137.181.158, hosted by Podaon SIA in the Netherlands, and is proxied through Cloudflare nameservers (ali.ns.cloudflare.com and zahir.ns.cloudflare.com). Registration occurred on May 4, 2026, via REGRU-RU, a registrar frequently associated with high-risk domains. The domain currently returns an HTTP 200 status, suggesting an operational phishing infrastructure, though the exact content remains unanalyzed beyond the detected page title 'slon4.at,' which does not directly reference Kraken. Infrastructure analysis reveals the use of Nginx as the web server technology, and the SSL certificate is issued by FASTPANEL, a provider often linked to low-reputation or parking domains. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 2 of 91 security vendors in VirusTotal scans. While the detection rate is low, the combination of brand impersonation, Cloudflare proxying, and recent registration heightens the risk profile. Defenders should prioritize blocking this domain at the DNS and network level, particularly in environments where Kraken-related services are accessed. Monitoring for connections to 188.137.181.158 and associated subdomains is recommended, as the infrastructure may be reused for additional phishing campaigns. Given the use of Cloudflare, traditional IP-based blocking may be less effective, necessitating domain-based mitigations. Further investigation into the page content and potential credential harvesting mechanisms is warranted, though no evidence of such functionality is currently available.