palq[.]ru

This domain is flagged as an elevated-risk brand impersonation phishing infrastructure targeting Kraken cryptocurrency exchange users. Analysis indicates the threat actor designed the site to harvest login credentials, API keys, and two-factor authentication codes by mimicking the official Kraken platform interface under the guise of localized access points. Infrastructure analysis reveals the domain palq.ru was registered through UK-WIN (ASN: 42237) and resolved to the IP address 91.236.116.20, hosted in Sweden under AS42237 (w1n ltd). The page title displayed "Кракен официальный сайт" followed by a list of redirect domains including kra17.cc, kra17.at, and others, suggesting a multi-domain phishing network. VirusTotal detection metrics show 13 out of 95 security vendors flagged this domain as malicious. The domain appears on one security blocklist and was taken offline after being identified. No SSL certificate was present, increasing the risk of plaintext credential interception. Organizations and individuals should implement the following mitigation steps specific to brand impersonation phishing: (1) Block the domain palq.ru and all associated redirect domains (kra17.cc, kra17.at, etc.) at the network perimeter using DNS filtering or firewall rules. (2) Monitor for credential reuse attempts from compromised accounts, particularly those associated with cryptocurrency exchanges. (3) Conduct user awareness training focused on identifying localized phishing attempts and verifying domain authenticity before entering sensitive information. (4) Implement multi-factor authentication (MFA) with phishing-resistant methods such as hardware tokens or app-based push notifications to reduce the impact of credential theft. (5) Review logs for connections to the IP address 91.236.116.20 and the ASN 42237 to identify potentially compromised systems.