ckrn[.]to

Analysis of the domain ckrn.to confirms its involvement in a tech support scam impersonating Google. The domain was registered through the Government of the Kingdom of Tonga on April 16, 2025, and is currently active. The page title, 'Калькулятор К - рассчитывайте и маскируйте онлайн,' suggests that the site may be targeting Russian-speaking users, but the exact content has not yet been fully analyzed. The SSL certificate is issued by Google Trust Services, which could be intended to lend credibility to the scam. The domain resolves to the IP address 188.114.97.3, which is located in the United States and is part of AS13335 Cloudflare, Inc. The site is flagged by one security vendor out of 95 on VirusTotal, and it has a Gridinsoft trust score of 0/100, indicating a high risk level. The domain is also blocked by PhishDestroy, further corroborating its malicious nature. Defenders should be vigilant and ensure that users are aware of the risks associated with visiting this domain. Given the impersonation of Google and the use of a trusted SSL certificate, users may be tricked into believing the site is legitimate, potentially leading to the disclosure of sensitive information. Network administrators should consider blocking this domain at the network level to prevent access. Additionally, any users who have interacted with the site should be advised to change their passwords and monitor their accounts for any unauthorized activity.