kraken[.]spravkimsk24[.]ru

Analysis indicates that the subdomain kraken.spravkimsk24.ru was registered on 7 February 2025 through the Russian registrar REGRU‑RU. The domain resolves to the IPv4 address 193.105.134.30, which is announced by AS42237 owned by w1n ltd and geolocated to Sweden. The authoritative nameservers are ns1.regerey.com and ns2.regerey.com, and the site does not present an SSL certificate, meaning all HTTP traffic is unencrypted. The page title returned from the live host, prior to takedown, is “Кракен - гид по CC национальным паркам Канады”, a Russian‑language phrase that references “Kraken” but describes a guide to Canadian national parks, suggesting a content mismatch intended to lure victims familiar with the Kraken brand. The domain is classified as a crypto‑related scam that impersonates the cryptocurrency exchange Kraken, aligning with the brand‑impersonation threat type.

VirusTotal records show that ten of ninety‑five scanning engines flagged the domain, indicating a moderate level of malicious detection. It appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Independent trust scoring from Gridinsoft assigns a score of 0 out of 100, reflecting a high confidence in malicious intent. The site is currently offline, and its status is recorded as taken offline. Uncertainty remains around the exact malicious payload or credential‑harvesting mechanisms, as no sample HTML or login page has been captured.

The lack of an SSL certificate prevents inspection of encrypted traffic, but the absence of TLS also suggests that any credential capture would occur over plain HTTP. Defenders should add the domain and its associated IP address to internal blocklists, monitor DNS queries for the subdomain pattern "*.spravkimsk24.ru", and enforce outbound filtering to prevent connections to the identified IP.