kra43cc-kraken[.]ru

Analysis of kra43cc-kraken.ru indicates a high‑risk brand‑impersonation campaign targeting users of the cryptocurrency exchange Kraken. The domain was registered through the NL‑PEETINVEST‑20060426 registrar and is hosted in the Netherlands under ASN 204601 (NovoServe B.V.). DNS resolution points to 81.91.178.50, and the authoritative nameservers are ns1.zomro.net, ns2.zomro.ru, ns3.zomro.com and ns4.zomro.su. No TLS certificate is presented, meaning the site is only reachable over HTTP, which simplifies traffic inspection. Google Safe Browsing classifies the URL as social engineering, and the domain is listed on a single security blocklist.

PhishDestroy has also blocked the domain. VirusTotal reports 15 of 95 scanners flagging the site, reinforcing the malicious assessment. The page title returned by the server is “Kra43 — Доступ через зеркала и домены”, a Russian phrase that does not reference Kraken directly but is consistent with the observed crypto‑scam classification. Gridinsoft assigns a trust score of 0 / 100, indicating extreme suspicion.

Defenders should add 81.91.178.50 and the full domain name to outbound‑filtering and DNS‑sinkhole rules, enforce HTTPS‑only policies to prevent accidental HTTP connections, and monitor for any traffic to the listed Zomro nameservers. Because the site is currently offline, continuous re‑resolution checks are advised to detect possible re‑hosting. Correlation with other Kraken‑related phishing indicators, such as similar sub‑domains or URL patterns, may reveal additional infrastructure. Incident response teams should treat any credential or cryptocurrency‑address submissions to this domain as compromised and advise affected users to reset credentials and verify wallet activity.