krab5--cc[.]ru

The domain krab5--cc.ru has been identified as a brand impersonation threat, specifically targeting the cryptocurrency exchange Kraken. The domain was designed to deceive users by mimicking the official Kraken website, potentially leading to credential theft or financial loss.

Technical analysis reveals that the domain has a VirusTotal detection score of 4/95, indicating a low level of detection among security vendors. The domain was registered on March 28, 2026, and resolves to the IP address 188.114.97.3. The SSL certificate for the domain is issued by Google Trust Services, which may contribute to a false sense of security among users. The domain appears in one threat intelligence pulse on AlienVault OTX and is listed on one security blocklist. The Gridinsoft trust score for the domain is 0/100, reflecting a complete lack of trust in the domain's legitimacy.

The domain is currently offline and has been taken down, likely as a result of security actions by PhishDestroy or other cybersecurity measures. Despite the domain being offline, the infrastructure and methods used in this campaign may still pose a risk if the attackers attempt to revive the domain or use similar tactics on other domains. Users are advised to remain vigilant and avoid clicking on any links or entering credentials on websites that do not have a verified and trusted SSL certificate. Additionally, regular updates to security software and awareness training can help mitigate the risk of falling victim to such attacks.