krab1-tor[.]ru

This report details the technical threat posed by the domain krab1-tor.ru. The site claims to be a new official mirror for "Kraken," referencing domains krab1 cc and krab1 at, as indicated by its page title. It is classified as a social media scam and impersonates the Facebook brand. The primary threat is that it serves as a phishing or fraudulent platform designed to deceive users by mimicking a legitimate service to steal credentials or personal information.

Technical analysis reveals that the domain was created on February 21, 2026. It has a VirusTotal detection rate of 7 out of 95 security vendors, with flags from alphaMountain.ai, BitDefender, CyRadar, ESET, and G-Data. It is also listed on 3 blocklists. The domain resolves to IP address 172.67.172.166, located in the United States, and is hosted by AS13335 Cloudflare, Inc. The SSL certificate used is identified as WE1.

The site is currently DOWN/OFFLINE, which mitigates immediate risk. However, its overall risk score is 70, indicating a high threat level. Users who previously accessed the site may be at risk, and the domain remains a potential vector for future malicious activity if reactivated.