# PhishDestroy domain threat record: blacksprut-ssilka.ru Content language: English Canonical HTML report: https://phishdestroy.io/domain/blacksprut-ssilka.ru/ Machine-readable companion: https://phishdestroy.io/domain/blacksprut-ssilka.ru/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-25 05:04:01 UTC - Last availability or vendor check: 2026-10-22 10:26:44 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 3/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 172.67.182.75 - Registrar in stored WHOIS data: DOMAINSHOP-RU - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-07-16 12:02:12 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0d6fd-dbf7-76ea-95c2-0ab4f2d73e21/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/blacksprut-ssilka.ru - Certificate Transparency search: https://crt.sh/?q=%25.blacksprut-ssilka.ru - Web Archive lookup: https://web.archive.org/web/*/https://blacksprut-ssilka.ru/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview blacksprut-ssilka.ru presents itself as "Водка Казино Официальный сайт Vodka Casino", claiming to be the official site of the Vodka Casino brand for Russian-speaking players. PhishDestroy classifies it as a fraudulent gambling site and first detected it on 2026-09-25. It was still online with live content on 2026-10-19. The domain name references Blacksprut and "ssilka" (Russian for "link"), while the page itself shows a casino. How the scam works Unofficial "official site" casino pages use a known brand name to win trust, then ask visitors to register and fund an account with promises of bonuses or free spins. The site keeps the deposits, and attempts to withdraw winnings are often stalled by extra verification demands, minimum turnover rules or payment "fees". Victims lose the money they deposited, plus any personal or payment details entered at sign-up. Evidence Three of 91 VirusTotal engines flagged the domain as of 2026-10-06: CRDF, Forcepoint ThreatSeeker and SOCRadar. That is a low count, so most security tools will not block the site yet. The domain appears in three AlienVault OTX threat pulses, which means other researchers have tracked it independently. PhishDestroy currently lists it on its blocklist. Infrastructure The domain was registered through DOMAINSHOP-RU on 2026-07-16, about ten weeks before PhishDestroy detected it. That gap fits a site that was set up, indexed and promoted before anyone reported it. Traffic passes through Cloudflare, Inc. on an address geolocated to Canada, so the real origin server is hidden behind the proxy. Its Google Trust Services certificate is standard for Cloudflare-fronted sites and does not mean the casino is legitimate. What to do Do not deposit money or claim bonuses on this site. If you already paid, contact your bank or card issuer right away to dispute the charges, and do not pay any "withdrawal fee" or "verification deposit" to release your winnings. Change any password you reused at sign-up and watch for phishing that uses the details you submitted. Defenders should block the domain at DNS and proxy level and report it to Cloudflare and the registrar so the origin can be traced and the site taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0d6fd-dbf7-76ea-95c2-0ab4f2d73e21/ VirusTotal report: https://www.virustotal.com/gui/domain/blacksprut-ssilka.ru Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=blacksprut-ssilka.ru Archived copy: https://web.archive.org/web/20260925050530/https://blacksprut-ssilka.ru/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:46:40 UTC ## Stored page captures - Primary capture: https://i.ibb.co/B5yTsv2S/3913852c2c75.png Captured: 2026-09-25 05:16:50 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0d6fd-dbf7-76ea-95c2-0ab4f2d73e21.png Captured: 2026-09-25 05:16:50 UTC Source report: https://urlscan.io/result/01a0d6fd-dbf7-76ea-95c2-0ab4f2d73e21/ - URLScan capture 2: https://urlscan.io/screenshots/01977a34-1294-70db-8ff8-df6d855799f0.png Captured: 2026-09-25 05:04:01 UTC Source report: https://urlscan.io/result/01a0d6fd-dbf7-76ea-95c2-0ab4f2d73e21/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d2efdc1a-8196-44bc-bfee-39ce3b4e10dd.png Captured: 2026-09-25 05:05:45 UTC Source report: https://radar.cloudflare.com/scan/d2efdc1a-8196-44bc-bfee-39ce3b4e10dd SHA-256: 2ca53dc5399e2c8d4e5e3e0ff170678c7ff025f72ac4e8b2ef0e535ac83d3574 - URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d6f6-0854-728c-89ad-fb75299a62c3.png Captured: 2026-09-25 05:07:39 UTC Source report: https://urlscan.io/result/01a0d6f6-0854-728c-89ad-fb75299a62c3/ SHA-256: 79d064166de2ffeef9e7245bb05f8a031645768c0ef91c8d304253ab832435f6 - URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d6f9-0425-74fb-b9eb-c8b4096649de.png Captured: 2026-09-25 05:10:50 UTC Source report: https://urlscan.io/result/01a0d6f9-0425-74fb-b9eb-c8b4096649de/ SHA-256: af9f00fa9a1f3b9dbfe0cc21bb77262fd5951b4acf76f5f2b473bc367484ca73 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T20:58:42Z", "uuid": "01a0d6fd-dbf7-76ea-95c2-0ab4f2d73e21", "scanned_at": "2026-09-25T05:16:03Z", "final_url": "https://blacksprut-ssilka.ru/", "status": 200, "ip": "172.67.182.75", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.14.94", "2a00:1450:4001:c15::5f", "172.67.182.75" ], "asns": [ "15169", "13335" ], "countries": [ "US", "DE" ], "doc_hash": "63cbc7ebc75267f6382e619eee2f4bdfc61817893bc2ec851c69a2789240f253", "script_hashes": [ "d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8" ], "globals": [ "requestResize", "$", "jQuery", "updateTimer", "pad" ], "tls": { "san": [ "blacksprut-ssilka.ru", "*.blacksprut-ssilka.ru" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "blacksprut-ssilka.ru", "protocol": "TLS 1.2", "valid_to": "2026-12-13T10:00:14Z", "valid_from": "2026-09-14T09:02:30Z" }, "domain_age_days": 1085, "apex_age_days": 1085, "tls_age_days": 10, "tls_valid_days": 90, "requests": 130, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T21:06:06Z", "uuid": "d2efdc1a-8196-44bc-bfee-39ce3b4e10dd", "scanned_at": "2026-09-25T05:05:45Z", "final_url": "https://blacksprut-ssilka.ru/", "status": 200, "history": [ { "url": "https://blacksprut-ssilka.ru/", "status": 200 } ], "dom_hash": "67b5120ef4952bb29072c5bac37af21ae958ea1076c67df845e70bb39aaf6c50", "doc_hash": "91a7ae8508df802dc0b9bf9f297e8f8ff7c7063dac1d862bc0fc4f4c977c3fb5", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "blacksprut-ssilka.ru", "type": "A", "value": "104.21.32.23" }, { "name": "blacksprut-ssilka.ru", "type": "A", "value": "172.67.182.75" } ], "dnssec_valid": false, "ip": "104.21.32.23", "whois": { "registrar": "DOMAINSHOP-RU", "created": "2026-07-16T14:02:12Z", "expires": "2027-07-16T14:02:12Z", "nameservers": [ "bonnie.ns.cloudflare.com", "weston.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T18:10:23Z", "analysis_at": "2026-10-05T02:00:08Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 3, "suspicious": 1, "undetected": 35 }, "detections": { "CRDF": "malicious", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "Dr.Web": "not recommended site/drugs" }, "registrar": "DOMAINSHOP-RU", "first_seen": "2023-10-14T03:40:17Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "bonnie.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.182.75" }, { "ttl": 21600, "type": "NS", "value": "weston.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "bonnie.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.32.23" } ], "dns_at": "2026-10-05T02:00:20Z", "jarm": "27d40d40d00040d00027d40d27d40dbc9595a9e7036a6bc0deff9a2ae690e7", "cert": { "san": [ "blacksprut-ssilka.ru", "*.blacksprut-ssilka.ru" ], "issuer": "Google Trust Services / WE1", "serial": "77bb1b969db94f80e85b2fa51feb473", "sha256": "7d8d153882b888d70afc98a7c89be6b92ec2b3a96c911d75e3e9413f2155ab29", "subject": "blacksprut-ssilka.ru", "valid_to": "2026-12-13T10:00:14Z", "valid_from": "2026-09-14T09:02:30Z" }, "whois": { "registrar": "DOMAINSHOP-RU" } } } ```