kraken[.]avito-evakuatory-uslugi[.]ru

The domain kraken.avito-evakuatory-uslugi.ru was registered on 2025-02-07 through the REGRU-RU registrar and is currently offline. Technical observation shows that the site did not present an SSL certificate and resolved to the IPv4 address 193.105.134.30, which is announced by AS42237 belonging to w1n ltd and geolocated to Sweden. The authoritative name servers are ns1.regerey.com and ns2.regerey.com.

The page title retrieved from the site, “Кракен - AT площадка для аренды складов”, references the Kraken brand, and the intelligence classifies the content as a crypto‑related scam that impersonates the Kraken exchange. VirusTotal reports eight positive detections out of ninety‑five scanners, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already blocked the host. Independent reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, indicating an extremely low credibility rating.

The limited visibility of the site, combined with the elevated risk rating, suggests that threat actors may have used the domain to lure victims into fraudulent cryptocurrency activities, although the exact payload or credential‑capture mechanisms have not been publicly disclosed. Defenders should continue to enforce domain‑level blocking for kraken.avito-evakuatory-uslugi.ru, add the associated IP address 193.105.134.30 to network‑level deny lists, monitor for additional domains registered with the same registrar or name‑servers, and consider updating detection rules to flag any future content that references the same page title or brand impersonation patterns. Ongoing telemetry collection is recommended to verify whether the infrastructure reappears under new labels.