century21-novostroiki[.]ru

On July 23 2026 the domain century21-novostroiki.ru was observed offline but retains indicators of a brand‑impersonation campaign targeting the cryptocurrency exchange Kraken. The authoritative name servers are erin.ns.cloudflare.com and trace.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure. DNS resolution points to the single IPv4 address 91.236.116.20, which is allocated to AS42237 (W1N Ltd) and geolocated to Sweden. The domain lacks an SSL/TLS certificate, indicating that any HTTP service would be delivered over plaintext. The page title returned from the now‑inactive host is "kraken клирнет зеркало - kra17.cc, kra17.at, kra18.cc, kra18.at, kra19.cc, kra19", directly referencing Kraken and a series of mirror sub‑domains.

This title confirms the intent to masquerade as a Kraken “mirror” site. The domain is classified as a crypto‑scam in the intelligence feed and is listed as a brand‑impersonation threat with an elevated risk rating. Reputation services provide extremely low trust scores: Gridinsoft assigns 0 / 100 and Scamadviser 1 / 100. The domain appears on one security blocklist and has been blocked by the PhishDestroy feed. VirusTotal analysis shows that 12 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of malicious activity.

Registrar information indicates registration through the UK‑WIN service, and the ASN attribution matches the hosting provider (AS42237). No HTTPS certificate is present, and the site’s HTTP status is not currently reachable because the host is offline. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been served while the site was active, as no content analysis is available. Defenders should continue to block the domain at DNS and proxy layers, add the associated IP 91.236.116.20 to deny‑list entries, and monitor for any resurgence of the host or related mirror sub‑domains (kra17.cc, kra18.cc, etc.).