# PhishDestroy domain threat record: instrukciya-kraken-vhod.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/instrukciya-kraken-vhod.ru/
Machine-readable companion: https://phishdestroy.io/domain/instrukciya-kraken-vhod.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-24 21:16:27 UTC
- Last availability or vendor check: 2026-10-22 10:29:13 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: RU-CENTER-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-03-26 09:29:05 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d548-06a5-76dc-a4ad-3ae77881376b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/instrukciya-kraken-vhod.ru
- Certificate Transparency search: https://crt.sh/?q=%25.instrukciya-kraken-vhod.ru
- Web Archive lookup: https://web.archive.org/web/*/https://instrukciya-kraken-vhod.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
instrukciya-kraken-vhod.ru is a phishing page that impersonates Kraken. Its Russian title translates to "Official Kraken Onion mirror via Tor. Secure login." The domain name itself means "Kraken login instructions." It is aimed at Russian-speaking users searching for a working way into a Kraken account. PhishDestroy first flagged it on 2026-09-24, and it was still online and serving content on 2026-10-19.

How the scam works
Users looking for a Kraken entry point often search for mirrors and login guides. This domain is built to catch those searches. The page promises a "safe" route to the Kraken Onion service and offers a login form that looks like the real one. Anything typed there, including usernames, passwords and one-time codes, goes to the operators. With those details they can take over the victim's real account and drain any balance held in it. The "official mirror" wording works on people who already expect to reach the service through unofficial links, which is why it is effective.

Evidence
Six of 92 VirusTotal engines flagged the domain as of 2026-10-07: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. That count is modest, so many browsers and filters will still let the page load without warning. Spamhaus lists the domain in its DBL under the phishing category. Four AlienVault OTX threat pulses reference it, and PhishDestroy carries it on its blocklist.

Infrastructure
The domain was registered on 2026-03-26 through RU-CENTER-RU, about six months before PhishDestroy detected it. That is long enough for it to build search visibility as a "login instructions" page. Its traffic resolves to Cloudflare, Inc. address space geolocated to Canada. Because Cloudflare acts as a proxy, the server that actually hosts the content stays hidden.

What to do
If you entered credentials on this page, log in to your real Kraken account through a source you already trust and change the password right away. Do the same on any other site where you used that password. Reset two-factor authentication, review recent logins and withdrawals, and move any remaining funds if you see activity you did not authorize. Never reach Kraken through mirror lists, search ads or "instruction" sites. Defenders should block the domain at DNS and proxy level and include it in phishing-awareness material for Russian-speaking staff. Abuse reports should go to Cloudflare and RU-CENTER while the page remains live.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d548-06a5-76dc-a4ad-3ae77881376b/
VirusTotal report: https://www.virustotal.com/gui/domain/instrukciya-kraken-vhod.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=instrukciya-kraken-vhod.ru
Archived copy: https://web.archive.org/web/20260924211655/https://instrukciya-kraken-vhod.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:49 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gM84MvD5/276920783805.png
  Captured: 2026-09-24 21:18:40 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d548-06a5-76dc-a4ad-3ae77881376b.png
  Captured: 2026-09-24 21:18:40 UTC
  Source report: https://urlscan.io/result/01a0d548-06a5-76dc-a4ad-3ae77881376b/
- URLScan capture 2: https://urlscan.io/screenshots/01a0b9d7-bdd2-7718-82d9-8269abaecc5e.png
  Captured: 2026-09-24 21:16:27 UTC
  Source report: https://urlscan.io/result/01a0d548-06a5-76dc-a4ad-3ae77881376b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e21520eb-b408-44b4-90b9-0267ce94dd59.png
  Captured: 2026-09-24 21:19:11 UTC
  Source report: https://radar.cloudflare.com/scan/e21520eb-b408-44b4-90b9-0267ce94dd59
  SHA-256: f452384ee078d954df3bc01c7b7f65c1c9573bfbe8e2b1452cc3b9d2eb89e3f6
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0b9d7-bdd2-7718-82d9-8269abaecc5e.png
  Captured: 2026-09-19 13:25:29 UTC
  Source report: https://urlscan.io/result/01a0b9d7-bdd2-7718-82d9-8269abaecc5e/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d54d-5bb1-743b-8f65-bd3c4ff96836.png
  Captured: 2026-09-24 21:23:42 UTC
  Source report: https://urlscan.io/result/01a0d54d-5bb1-743b-8f65-bd3c4ff96836/
  SHA-256: 10b08919c07d569c4b7a56734a20731de450a5513cda9bef74e21143a742db43

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:43Z",
        "uuid": "01a0d548-06a5-76dc-a4ad-3ae77881376b",
        "scanned_at": "2026-09-24T21:17:56Z",
        "final_url": "https://instrukciya-kraken-vhod.ru/",
        "status": 200,
        "ip": "172.67.206.70",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru",
            "static.cloudflareinsights.com",
            "mdd.yandex.net",
            "hdrc.yandex.net"
        ],
        "ips": [
            "77.88.21.119",
            "104.16.79.73",
            "172.67.206.70"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "xn--sln18-vta.cc",
            "krakenu6upk4yrcys6nv25du7ntl7inovhnepkevynfdgkjekkklrgqd.onion"
        ],
        "doc_hash": "b6aa9d8e5f4069a5f5a7c9601231c5f14710f5002a94061a63440fdf44152568",
        "script_hashes": [
            "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "requestResize",
            "ym",
            "_wpemojiSettings",
            "__cfBeacon",
            "twemoji",
            "wp",
            "Ya",
            "yaCounter112384039",
            "dataLayer"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_ymBRC",
            "_ym_synced",
            "_ym112384039_lsid",
            "_ym112384039:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "*.instrukciya-kraken-vhod.ru",
                "instrukciya-kraken-vhod.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "instrukciya-kraken-vhod.ru",
            "protocol": "QUIC",
            "valid_to": "2026-12-18T12:08:04Z",
            "valid_from": "2026-09-19T12:08:05Z"
        },
        "domain_age_days": 182,
        "apex_age_days": 182,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 52,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 77,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:55Z",
        "uuid": "e21520eb-b408-44b4-90b9-0267ce94dd59",
        "scanned_at": "2026-09-24T21:19:11Z",
        "final_url": "https://instrukciya-kraken-vhod.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://instrukciya-kraken-vhod.ru/",
                "status": 200
            }
        ],
        "dom_hash": "237c7b243dad80db458c4aff5eb6a18b57aeaa9044ba9805ccdd2187a959d649",
        "doc_hash": "b6aa9d8e5f4069a5f5a7c9601231c5f14710f5002a94061a63440fdf44152568",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "instrukciya-kraken-vhod.ru",
                "type": "A",
                "value": "172.67.206.70"
            },
            {
                "name": "instrukciya-kraken-vhod.ru",
                "type": "A",
                "value": "104.21.66.177"
            },
            {
                "name": "instrukciya-kraken-vhod.ru",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:ce46"
            },
            {
                "name": "instrukciya-kraken-vhod.ru",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:42b1"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.206.70",
        "whois": {
            "registrar": "RU-CENTER-RU",
            "created": "2026-03-26T10:29:05Z",
            "expires": "2027-03-26T10:29:05Z",
            "nameservers": [
                "amos.ns.cloudflare.com",
                "kay.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:35:20Z",
        "analysis_at": "2026-10-07T02:04:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 4,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Dr.Web": "drugs",
            "Google": "drugs",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-03-26T00:00:00Z",
        "first_seen": "2026-03-26T11:45:34Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.206.70"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.66.177"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kay.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "amos.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "amos.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:42b1"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "google-site-verification=kNIHMnMATaU6kNlY1_bC6UahHeWbG00zT-WpDa6mO5Y"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:ce46"
            }
        ],
        "dns_at": "2026-10-07T02:04:43Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.instrukciya-kraken-vhod.ru",
                "instrukciya-kraken-vhod.ru"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6c5bf450b48b0f86ca43af57f9f109a0d53",
            "sha256": "d4922bd1395f050c79a7f0823879062ca0529c23a2a3856a566e99c7881afa8a",
            "subject": "instrukciya-kraken-vhod.ru",
            "valid_to": "2026-12-18T12:08:04Z",
            "valid_from": "2026-09-19T12:08:05Z"
        }
    }
}
```