# PhishDestroy domain threat record: instrukciya-kraken.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/instrukciya-kraken.ru/
Machine-readable companion: https://phishdestroy.io/domain/instrukciya-kraken.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-24 23:51:25 UTC
- Last availability or vendor check: 2026-10-22 22:31:33 UTC
- Stored record updated: 2026-10-22 22:31:33 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 104.21.57.72
- Registrar in stored WHOIS data: RU-CENTER-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-03-26 09:29:09 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d5d6-0d27-7497-a260-5d12a1cd140f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/instrukciya-kraken.ru
- Certificate Transparency search: https://crt.sh/?q=%25.instrukciya-kraken.ru
- Web Archive lookup: https://web.archive.org/web/*/https://instrukciya-kraken.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
instrukciya-kraken.ru is a phishing page that impersonates Kraken. It targets Russian-speaking users with a page titled "Официальное зеркало Kraken Onion через Tor. Безопасный вход." ("Official Kraken Onion mirror via Tor. Secure login."). The domain name itself is a transliteration of the Russian for "Kraken instructions", which makes it look like a helpful guide. PhishDestroy first flagged it on 2026-09-25, and it was still online and serving content on 2026-10-19.

How the scam works
The page presents itself as a verified "official mirror" that offers a safe route to Kraken. That pitch works on people searching for a working link or login instructions. Visitors are steered to a login form controlled by the operators, and anything typed there goes straight to them: usernames, passwords and one-time codes. With those credentials the attackers can take over the account and move out whatever funds it holds. The promise of a "secure login" is the bait, not a protection.

Evidence
Six of 92 engines on VirusTotal flagged the domain as of 2026-10-07: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. That count is modest, so many security tools will still let the page load without a warning. Spamhaus lists the domain in its DBL under the phishing category, which matters for mail and DNS filtering. It also appears in four AlienVault OTX threat pulses, and PhishDestroy carries it on its blocklist.

Infrastructure
The domain was registered through RU-CENTER on 2026-03-26, roughly six months before PhishDestroy detected it. That gap suggests it was either kept in reserve or ran quietly for months. The site sits behind Cloudflare, with a Canadian edge address, so the actual origin server is hidden from view. Its Let's Encrypt certificate only means the connection is encrypted; the padlock says nothing about whether the site is honest.

What to do
If you entered a Kraken login on this page, change that password immediately from the genuine service and reset two-factor authentication. Check your account for unfamiliar sessions, API keys, withdrawal addresses and recent withdrawals. Change the password anywhere else you reused it. In future, reach Kraken only through a saved bookmark, never through "mirror" links or instruction sites. Defenders should block the domain at DNS, proxy and mail gateways, and search logs for users who visited it so their credentials can be reset.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d5d6-0d27-7497-a260-5d12a1cd140f/
VirusTotal report: https://www.virustotal.com/gui/domain/instrukciya-kraken.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=instrukciya-kraken.ru
Archived copy: https://web.archive.org/web/20260924235321/https://instrukciya-kraken.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:46 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gM84MvD5/276920783805.png
  Captured: 2026-09-24 23:53:42 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d5d6-0d27-7497-a260-5d12a1cd140f.png
  Captured: 2026-09-24 23:53:42 UTC
  Source report: https://urlscan.io/result/01a0d5d6-0d27-7497-a260-5d12a1cd140f/
- URLScan capture 2: https://urlscan.io/screenshots/01a0b96e-246f-742c-a509-fcc97f8bfd23.png
  Captured: 2026-09-24 23:51:25 UTC
  Source report: https://urlscan.io/result/01a0d5d6-0d27-7497-a260-5d12a1cd140f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e0e4cb81-d9ad-4c62-85d2-50516bb45ff6.png
  Captured: 2026-09-24 23:54:57 UTC
  Source report: https://radar.cloudflare.com/scan/e0e4cb81-d9ad-4c62-85d2-50516bb45ff6
  SHA-256: 9dc58270f79c20e9faa87e61f7c57c3c7481ea550cbdacb65dd87bca957560e3
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0b96e-246f-742c-a509-fcc97f8bfd23.png
  Captured: 2026-09-19 11:30:06 UTC
  Source report: https://urlscan.io/result/01a0b96e-246f-742c-a509-fcc97f8bfd23/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d5da-8f4f-77cc-b51d-5d6da9dbbf24.png
  Captured: 2026-09-24 23:57:51 UTC
  Source report: https://urlscan.io/result/01a0d5da-8f4f-77cc-b51d-5d6da9dbbf24/
  SHA-256: 10b08919c07d569c4b7a56734a20731de450a5513cda9bef74e21143a742db43

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:35Z",
        "uuid": "01a0d5d6-0d27-7497-a260-5d12a1cd140f",
        "scanned_at": "2026-09-24T23:53:03Z",
        "final_url": "https://instrukciya-kraken.ru/",
        "status": 200,
        "ip": "172.67.161.120",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru",
            "static.cloudflareinsights.com",
            "mdd.yandex.net",
            "hdrc.yandex.net"
        ],
        "ips": [
            "87.250.251.119",
            "87.250.250.119",
            "77.88.21.119",
            "104.16.80.73",
            "172.67.161.120"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "xn--sln18-vta.cc",
            "krakenu6upk4yrcys6nv25du7ntl7inovhnepkevynfdgkjekkklrgqd.onion"
        ],
        "doc_hash": "05fc0e236980af7aa2cc6c33ae02531239d978890db73192e28478fa83f1c139",
        "script_hashes": [
            "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "requestResize",
            "ym",
            "_wpemojiSettings",
            "__cfBeacon",
            "Ya",
            "yaCounter112384039",
            "dataLayer",
            "twemoji",
            "wp"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc",
            "mdd"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_ymBRC",
            "_ym_synced",
            "_ym112384039_lsid",
            "_ym112384039:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "*.instrukciya-kraken.ru",
                "instrukciya-kraken.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "instrukciya-kraken.ru",
            "protocol": "QUIC",
            "valid_to": "2026-12-18T10:38:50Z",
            "valid_from": "2026-09-19T10:38:51Z"
        },
        "domain_age_days": 182,
        "apex_age_days": 182,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 52,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 79,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:49Z",
        "uuid": "e0e4cb81-d9ad-4c62-85d2-50516bb45ff6",
        "scanned_at": "2026-09-24T23:54:57Z",
        "final_url": "https://instrukciya-kraken.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://instrukciya-kraken.ru/",
                "status": 200
            }
        ],
        "dom_hash": "237c7b243dad80db458c4aff5eb6a18b57aeaa9044ba9805ccdd2187a959d649",
        "doc_hash": "05fc0e236980af7aa2cc6c33ae02531239d978890db73192e28478fa83f1c139",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "instrukciya-kraken.ru",
                "type": "A",
                "value": "172.67.161.120"
            },
            {
                "name": "instrukciya-kraken.ru",
                "type": "A",
                "value": "104.21.57.72"
            },
            {
                "name": "instrukciya-kraken.ru",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:a178"
            },
            {
                "name": "instrukciya-kraken.ru",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:3948"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.161.120",
        "whois": {
            "registrar": "RU-CENTER-RU",
            "created": "2026-03-26T10:29:09Z",
            "expires": "2027-03-26T10:29:09Z",
            "nameservers": [
                "amos.ns.cloudflare.com",
                "kay.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:34:32Z",
        "analysis_at": "2026-10-07T02:05:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 4,
            "suspicious": 2,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Dr.Web": "drugs",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-03-26T00:00:00Z",
        "first_seen": "2026-03-26T11:45:26Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kay.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.57.72"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:a178"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.161.120"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "amos.ns.cloudflare.com"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "google-site-verification=C6MQsCKHusedO4Unj_DRGIEj64fBt7SW3Zv5Y0aX20I"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "amos.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:3948"
            }
        ],
        "dns_at": "2026-10-07T02:05:17Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.instrukciya-kraken.ru",
                "instrukciya-kraken.ru"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "53a0e3b155885a88e4f6017d7ec585dbc34",
            "sha256": "2474fb9895b1b00b0137c1c5b42dad35de7db745461887aa663c74bdeffc599f",
            "subject": "instrukciya-kraken.ru",
            "valid_to": "2026-12-18T10:38:50Z",
            "valid_from": "2026-09-19T10:38:51Z"
        }
    }
}
```