kra36[.]vip

Analysis indicates that the domain kra36.vip was registered on August 31, 2025 through NiceNIC International Group Co., Limited. The domain resolves to the IPv4 address 101.99.76.111, which is assigned to AS45839 (Shinjiru Technology Sdn Bhd) and geolocated to the Netherlands. A Let’s Encrypt R13 certificate secures the site, and passive fingerprinting shows the web stack consists of Ubuntu, Nginx, Node.js and the Express framework. The authoritative name servers listed are ns0.1984.is, ns1.1984.is, ns1.1984hosting.com, ns2.1984.is and ns2.1984hosting.com.

The page title retrieved before takedown reads “Razer Kraken Blog – Обзоры и новости наушников”, indicating an attempt to leverage the Kraken brand, specifically the Razer Kraken headset line, for a brand‑impersonation campaign. The domain is currently offline but was previously flagged by eight of ninety‑five VirusTotal scanners and appears on a single public blocklist, where it has been added by PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing its malicious classification. The risk rating assigned by the reporting system is elevated.

Uncertainty remains regarding the exact payload delivered to victims; no malware samples or post‑exploitation behavior have been publicly disclosed. The specific cryptocurrency scam mechanics have not been observed, and no phishing login page snapshots are available. Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering and threat‑intel feeds with the observed indicators, and monitor for any resurrection of the host under related subdomains or alternative IP allocations. Ongoing verification of DNS records and periodic re‑scans with multi‑engine services are recommended to capture any changes in the threat posture.