kraken[.]klcloud[.]ru

This domain is flagged as a high-risk brand impersonation threat specifically targeting Kraken, a major cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into disclosing sensitive credentials or financial information under the guise of legitimate Kraken services, as evidenced by the page title 'Главная страница сайта' and the absence of an SSL certificate. Infrastructure analysis reveals the domain kraken.klcloud.ru was registered on February 07, 2024, through BEGET-RU. It resolves to the IP address 62.217.176.53, located in Russia under AS198610 (Beget LLC). The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports 13 out of 95 security vendors detecting this domain as malicious, further corroborating its threat status. The domain currently lacks an SSL certificate, increasing the risk of credential interception during transmission. Mitigation steps for this type of threat include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should update endpoint protection rules to flag or quarantine any attempts to access kraken.klcloud.ru. Users who may have interacted with this domain should be instructed to reset their Kraken account credentials from a verified, secure device and enable multi-factor authentication. Security teams are advised to monitor for unusual login attempts or transactions originating from the identified IP range, particularly those associated with AS198610. Given the domain's recent creation and active detection by security vendors, continuous monitoring for similar impersonation domains is recommended.