kraken[.]nvs-bankrot-netdolgov[.]ru

Analysis of kraken.nvs-bankrot-netdolgov.ru shows a newly registered domain (creation date February 08, 2025) that is currently taken offline. The domain resolves to IP address 193.105.134.30, which belongs to AS42237 w1n ltd and is geolocated in Sweden. No TLS certificate is presented, indicating that the site would have been served only over HTTP. The authoritative nameservers are ns1.regerey.com and ns2.regerey.com, both associated with the registrar REGRU-RU.

The page title returned from the host is "AvocadoGuard Security — Корпоративная защита от DDoS," a mismatch to the claimed brand target, Kraken, and suggests the site was attempting to disguise itself as a security product while leveraging the Kraken brand. Gridinsoft assigns a trust score of 0/100, reflecting extreme suspicion. The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis reports 12 of 95 scanning engines flagging the host, confirming malicious activity.

The listed scam type is "Crypto Scam," reinforcing the hypothesis that the domain was used to lure victims into fraudulent cryptocurrency transactions under the guise of Kraken services. While the site is offline, the infrastructure elements—low‑reputation registrar, no HTTPS, zero trust score, and multiple vendor detections—provide strong indicators of abuse. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP for any re‑use, and add the domain to internal threat‑intel feeds. Future investigations should verify whether the AvocadoGuard title was a reused template and assess any related domains registered through the same nameservers for similar impersonation attempts.