web[.]kraken19at-t[.]ru

This domain, web.kraken19at-t.ru, poses a direct threat to users by impersonating the Kraken cryptocurrency exchange platform. The site mimics legitimate Kraken branding, including a page title in Russian ('Веб-торговля - Kraken Marketplace'), to deceive visitors into entering sensitive credentials or financial information. Such impersonation attacks are commonly used to steal login details, private keys, or facilitate unauthorized transactions, putting users' digital assets at risk. Analysis indicates the domain was registered on December 2, 2025, through REGRU-RU, a registrar with a history of hosting malicious infrastructure. The domain lacks an SSL certificate, a red flag for secure connections, and resolves to the IP address 31.31.196.214, located in Russia under AS197695. Security vendors have flagged this domain as malicious, with 11 out of 95 engines on VirusTotal detecting it. Additionally, it appears on one security blocklist and was proactively taken offline after being identified as a threat. If you visited web.kraken19at-t.ru, immediate action is required. First, disconnect the device from the network to prevent potential data exfiltration. Next, change passwords for any accounts accessed from the device, particularly cryptocurrency wallets or exchange platforms, using a separate, secure device. Enable multi-factor authentication where available. Monitor financial accounts and transaction histories for unauthorized activity. If credentials were entered, assume they are compromised and revoke access to any linked services. Consider scanning the device for malware using updated security tools, as phishing sites may deploy additional payloads.