skoda-volkswagen[.]ru

This domain skoda-volkswagen.ru was observed hosting a cryptocurrency‑related impersonation page targeting the Kraken brand. The site’s HTML title reads "Kraken krab2 – технический центр Skoda и Volkswagen CC класса", indicating an attempt to combine the legitimate Kraken name with Russian automotive terms. The domain was registered on 27 March 2025 via the REGRU‑RU registrar and points to the IP address 186.2.175.37, which belongs to AS59692 (IQWeb FZ‑LLC) located in Belize. Cloudflare name servers (amir.ns.cloudflare.com and erin.ns.cloudflare.com) are in use, a pattern commonly seen in fast‑flux or abuse‑resistant hosting.

No TLS certificate was presented, so all traffic would have been unencrypted HTTP. VirusTotal recorded detections from eight of ninety‑three scanners, and the domain appears on a single public blocklist, currently blocked by PhishDestroy. The page was classified as a crypto scam and the overall threat level is elevated. As of the report date (23 July 2026) the site is offline, limiting immediate observation, but the infrastructure components remain active.

Defenders should add the resolve IP 186.2.175.37 to network‑level deny lists, monitor for any new sub‑domains under the same registrar or name‑server set, and enforce strict outbound filtering for connections to that IP range. Email gateways should flag any messages containing references to Kraken that originate from this domain or its IP. Continuous re‑scanning on VirusTotal or similar platforms is advised to capture any changes in detection status. Because the page content has not been captured, further analysis of the payload (e.g., malicious scripts or wallet addresses) is pending.