lichniikabinet[.]ru

This domain, lichniikabinet.ru, is identified as a brand impersonation threat targeting Kraken, a major cryptocurrency exchange platform. The site mimics legitimate Kraken login portals to deceive users into entering sensitive credentials, such as account logins, private keys, or two-factor authentication codes. The page title, 'КРАКЕН — гастротуры: знакомство с кухнями мира,' is deceptive, as it references unrelated content while the underlying infrastructure is designed for credential harvesting. The domain’s fraudulent intent is further supported by its association with cryptocurrency-related phishing, a common tactic to exploit users seeking access to digital asset platforms.

Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered through RU-CENTER-RU on February 21, 2026, and currently resolves to the IP address 186.2.175.37. It appears on three security blocklists and is flagged by 3 out of 95 security vendors on VirusTotal, including detection by MetaMask, SEAL, and PhishDestroy. Additionally, the domain holds a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk infrastructure. The combination of brand impersonation, blocklist presence, and low detection thresholds confirms its role in active phishing campaigns.

Users who visited lichniikabinet.ru should assume their credentials or sensitive information may have been compromised. Immediate actions include revoking access to any linked cryptocurrency wallets, enabling multi-factor authentication on all accounts, and monitoring for unauthorized transactions. If financial assets were exposed, affected parties should report the incident to relevant authorities and consider freezing accounts to prevent further exploitation. The domain is currently offline, but users should remain vigilant for similar threats targeting cryptocurrency platforms.