kra-b4-cc[.]ru

PhishDestroy identifies kra-b4-cc.ru as a confirmed phishing domain engaged in brand impersonation, specifically targeting users of the Kraken cryptocurrency exchange platform through a fake login page titled "krab4cc - Обновленная Ссылка". The domain is currently offline, but its history and indicators suggest a sophisticated credential theft operation. Registered on March 28, 2026, the site was hosted on IP address 5.23.52.13 and secured with a Let's Encrypt SSL certificate (E8), lending it a false sense of legitimacy.

Technical analysis reveals that the domain is flagged by only 1 out of 95 VirusTotal security vendors, indicating that its malicious nature has been largely undetected by mainstream security tools. It also appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. The relatively recent creation date and low blocklist presence suggest this was a carefully prepared threat designed to evade detection. The SSL certificate from Let's Encrypt further obscures its malicious intent, as many legitimate sites also use this certificate authority.

As the domain is now offline, the immediate risk of interaction is minimal. However, PhishDestroy recommends that users who may have visited kra-b4-cc.ru or entered credentials should immediately change their passwords and enable two-factor authentication on their accounts. Security teams should monitor for any related domains or IP addresses that may resurface under similar names. Regular checks against threat intelligence feeds and user education on recognizing brand impersonation tactics are essential to prevent future compromises.