krab2atttttttt-a[.]ru

Analysis of the domain krab2atttttttt-a.ru indicates a targeted brand impersonation campaign aimed at the cryptocurrency exchange Kraken. The domain was registered through REGRU-RU on December 23, 2025 and presently resolves to the IP address 186.2.175.37, which is allocated to the BZ region under AS59692 owned by IQWeb FZ-LLC. Infrastructure examination shows the domain is served by Cloudflare nameservers (ganz.ns.cloudflare.com and pola.ns.cloudflare.com) and lacks an SSL certificate, suggesting the site was not served over HTTPS. The page title retrieved from the site reads "Kraken krab2 - AT‑сообщество для единомышленников," reinforcing the use of the Kraken brand in the content.

Security telemetry reports that 13 of 93 VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, confirming its classification as a crypto‑related scam. Current status shows the site is offline, limiting immediate interaction but not eliminating the risk of future re‑activation.

Defenders should continue to monitor the associated IP range and Cloudflare name servers for any resurgence, enforce blocklists that include this domain, and advise users to verify Kraken URLs against official channels. Further investigation is needed to determine whether any phishing kits or credential harvesting mechanisms were deployed before takedown, as the exact page content beyond the title remains unverified.