kraken[.]krab2cc[.]sbs

On July 25, 2026 the domain kraken.krab2cc.sbs was identified as an elevated‑risk brand‑impersonation site targeting Kraken users. The domain was registered on December 21, 2025 through Global Domain Group LLC and resolves to the IPv4 address 91.236.116.210, which is hosted in Sweden under AS42237 (w1n ltd). DNS resolution is provided by ns1.armadns.com and ns2.armadns.com. No SSL certificate is presented, leaving the site reachable only over HTTP. Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of reputation.

VirusTotal recorded seven detections out of ninety‑three submitted scanners, and Google Safe Browsing classifies the URL as a social‑engineering threat. The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. The page title returned by the server is “kraken.krab2cc.sbs”, matching the domain name exactly. The campaign is labeled as a crypto scam, and the brand target is explicitly Kraken.

The hosting infrastructure and registrar provide no indication of legitimate ownership, and the absence of HTTPS further undermines user trust. At the time of analysis the domain is offline, limiting immediate exposure, but historical activity suggests it was used to lure victims into a fraudulent cryptocurrency workflow. Defenders should continue to block the domain at DNS and proxy layers, monitor for re‑registration, and enrich telemetry with the observed IP, nameserver, and detection signatures. Additional investigation of the associated IP address and any related domains that share the same nameservers may reveal a broader campaign infrastructure.