krab1---------cc[.]ru

This domain, krab1---------cc.ru, is identified as a brand impersonation threat targeting Kraken, a major cryptocurrency exchange. Analysis indicates the site was designed to deceive users into entering login credentials or financial details under the pretense of accessing Kraken services. The page title, "Страница каркен," directly references the brand in Cyrillic script, suggesting a targeted approach toward Russian-speaking users or those familiar with the exchange’s regional presence. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 6 out of 95 security vendors on VirusTotal, resolving to the IP address 186.2.175.37. It was registered on December 9, 2025, through the registrar REGRU-RU, a provider frequently associated with malicious domains. The Gridinsoft trust score for this domain is 0 out of 100, further corroborating its malicious classification. Currently, the domain appears on one security blocklist and has been actively blocked by at least one threat intelligence feed. As of the latest assessment, krab1---------cc.ru has been taken offline, likely in response to detection and reporting by security entities. However, the infrastructure remains a residual risk, as threat actors may repurpose the IP or registrar for future campaigns. Users who interacted with the domain prior to its takedown should assume credential compromise and initiate account recovery protocols, including password resets and multi-factor authentication reviews. Organizations are advised to monitor for related indicators, such as the IP address and registrar, in their network logs.