kraken-krab2[.]cfd

The domain kraken-krab2.cfd was registered on December 25, 2025 through Global Domain Group LLC and is currently taken offline. Infrastructure analysis shows that the domain resolved to the IP address 186.2.175.37, which is announced by AS59692 and associated with IQWeb FZ-LLC in Belize. The hosting provider does not present an SSL certificate, leaving the site exposed to plain‑HTTP traffic. Nameserver records point to Google Cloud DNS (ns-cloud-d1.googledomains.com through ns-cloud-d3.googledo), indicating the attacker leveraged a reputable DNS service to mask malicious intent.

The site’s page title, "Kraken krab2 - AT‑система франчайзинга на основе больших данных," does not reference the legitimate Kraken brand, yet the domain is explicitly listed as impersonating Kraken and is classified as a crypto‑related scam. Google Safe Browsing flagged the URL for social engineering, and the site appears on a single security blocklist, where it was also blocked by the PhishDestroy service. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100.

VirusTotal analysis recorded nine positive detections out of ninety‑three scanned engines, reinforcing the malicious assessment. While the offline status limits immediate interaction, the combination of registrar information, IP ownership, lack of TLS, and multiple independent detections suggests a deliberate attempt to deceive Kraken users for cryptocurrency fraud. Defenders should continue to block the domain at perimeter devices, update threat‑intel feeds with the observed indicators, monitor for any re‑registration attempts, and consider broader hunting for related infrastructure tied to AS59692 or the same DNS pattern.