krab--5----cc[.]ru

Analysis of krab--5----cc.ru shows a confirmed brand‑impersonation campaign targeting the cryptocurrency exchange Kraken. The domain was registered on 21 February 2026 through RU‑CENTER‑RU and resolves to IP 186.2.175.37, which is announced by AS59692 (IQWeb FZ‑LLC) and geolocated to Belarus. The host returns HTTP 502, indicating the web service is currently unavailable, and the site is marked as offline. A Let’s Encrypt R12 certificate covers the domain, confirming TLS is in use despite the service disruption. Cloudflare nameservers (marjory.ns.cloudflare.com and terry.ns.cloudflare.com) are configured, suggesting the operators leveraged Cloudflare’s CDN and DNS protection.

The page title discovered during a prior fetch reads “Krab5 CC | Онлайн агрегатор по созданию сайтов!”, a generic Russian‑language phrase that does not reference Kraken, but the documented scam type explicitly lists brand impersonation of Kraken. Technical footprints include Yandex.Metrika analytics and DDoS‑Guard protection, both common in malicious Russian‑hosted sites. VirusTotal scans flagged the domain by 2 of 93 vendors, and Gridinsoft assigns a trust score of 0 / 100. Independent blocklists and security services (PhishDestroy, MetaMask, SEAL) have already listed the domain, and it appears on three additional blocklists.

The combination of low trust scoring, vendor detections, and active blocklisting indicates a high probability of malicious intent. Uncertainty remains around the exact payload or credential‑harvesting mechanisms because the site is offline and no page content has been captured. Defenders should continue to block the domain at perimeter and DNS layers, monitor the hosting IP for related activity, and update incident response playbooks to include Kraken‑related impersonation vectors. Threat intelligence feeds should be refreshed with the domain’s identifiers to ensure rapid detection of any re‑use of the same infrastructure.