krab-2-att-a[.]ru

Analysis of the domain krab-2-att-a.ru indicates it was used in a brand‑impersonation campaign targeting users of the cryptocurrency exchange Kraken. The domain was registered on 23 December 2025 through the REGRU‑RU registrar and currently resolves to the IPv4 address 186.2.175.37, which is allocated to AS59692 (IQWeb FZ‑LLC) in Belarus. The site’s page title, observed before takedown, reads “Kraken krab2 – AT‑сообщество энтузиастов хабтовской культуры”, suggesting a Russian‑language theme but providing no further visual evidence of the landing page. No TLS certificate was present, meaning the service was offered over plain HTTP only.

Security‑vendor scans on VirusTotal reported that 13 of 93 engines flagged the domain as malicious, and the Gridinsoft trust score was recorded as 0 / 100, reinforcing the malicious assessment. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that threat‑intel communities consider it a confirmed malicious indicator. Cloudflare nameservers (ganz.ns.cloudflare.com and pola.ns.cloudflare.com) were in use, which may have been employed to hide the true hosting provider or to facilitate rapid DNS changes. The campaign is classified as a crypto‑scam, leveraging the Kraken brand to lure victims into fraudulent financial interactions.

Because the site is currently offline, active detection is limited to historical artifacts such as the DNS records, IP address, and the observed page title. Defenders should add krab-2-att-a.ru and its resolved IP 186.2.175.37 to block lists, monitor for re‑registration or resurrection of the domain, and watch for similarly structured domains that combine “krab” or “krab2” with Kraken‑related keywords. Network‑level controls that drop traffic to the identified IP range, as well as URL‑filtering rules that deny HTTP connections to the domain, will mitigate repeat attempts.