# PhishDestroy domain threat record: kraken-ssilka-slon.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/kraken-ssilka-slon.ru/
Machine-readable companion: https://phishdestroy.io/domain/kraken-ssilka-slon.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-25 00:22:50 UTC
- Last availability or vendor check: 2026-10-22 10:29:27 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 4/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 172.67.171.253
- Registrar in stored WHOIS data: RU-CENTER-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-08 07:32:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d5f2-3513-7768-b751-3ce5b1ca3978/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/kraken-ssilka-slon.ru
- Certificate Transparency search: https://crt.sh/?q=%25.kraken-ssilka-slon.ru
- Web Archive lookup: https://web.archive.org/web/*/https://kraken-ssilka-slon.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
kraken-ssilka-slon.ru is an impersonation phishing page built around the Kraken name. Its Russian-language title reads "Official Kraken Onion mirror via Tor. Secure login," and the domain itself translates loosely to "kraken-link." It targets Russian-speaking users who search for a working Kraken link instead of reaching the service through a trusted route. PhishDestroy first flagged it on 2026-09-25, and the site was still up and serving content on 2026-10-19.

How the scam works
Fake "mirror" sites take advantage of users who regularly hunt for fresh entry links. This page claims to be an official, safe gateway and offers a login form that looks like the real Kraken sign-in. Anything typed there goes to the operators, including the username, the password and any one-time code. With those details they can take over the real account and drain whatever balance it holds. Some victims are also pushed to make a deposit through the look-alike interface, and that money goes directly to the scammers.

Evidence
Independent detection is still limited. On 2026-10-06, 4 of 91 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker and SOCRadar. It also appears in 4 AlienVault OTX threat pulses, which means other researchers have tied it to malicious activity. Among blocklists, only PhishDestroy currently lists it, so most browsers and filters will not warn a visitor yet.

Infrastructure
The domain was registered through RU-CENTER on 2026-04-08, about five and a half months before PhishDestroy caught it. That gap suggests it was either set aside in advance or ran quietly for months. The site sits behind Cloudflare, and the Canadian location reflects Cloudflare's network rather than the operators' real server. It uses a free Let's Encrypt certificate, so the padlock in the browser says nothing about whether the site is legitimate.

What to do
If you entered credentials on this page, change your Kraken password at once from a trusted source. Reset two-factor authentication and end all active sessions. Check your account history for logins, withdrawals or setting changes you did not make. Do not send funds to any deposit address this page shows you. If you reused the password elsewhere, change it on those services too. Defenders should block the domain at DNS and proxy level, add it to phishing filters and report it to Cloudflare and RU-CENTER for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d5f2-3513-7768-b751-3ce5b1ca3978/
VirusTotal report: https://www.virustotal.com/gui/domain/kraken-ssilka-slon.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kraken-ssilka-slon.ru
Archived copy: https://web.archive.org/web/20260925002536/https://kraken-ssilka-slon.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:45 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gM84MvD5/276920783805.png
  Captured: 2026-09-25 00:24:27 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d5f2-3513-7768-b751-3ce5b1ca3978.png
  Captured: 2026-09-25 00:24:27 UTC
  Source report: https://urlscan.io/result/01a0d5f2-3513-7768-b751-3ce5b1ca3978/
- URLScan capture 2: https://urlscan.io/screenshots/019fd2be-8ef5-7203-9a4c-654a0571d8b4.png
  Captured: 2026-09-25 00:22:50 UTC
  Source report: https://urlscan.io/result/01a0d5f2-3513-7768-b751-3ce5b1ca3978/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b146a6cd-f421-4ba4-9522-1a9b574ac4db.png
  Captured: 2026-09-25 00:24:31 UTC
  Source report: https://radar.cloudflare.com/scan/b146a6cd-f421-4ba4-9522-1a9b574ac4db
  SHA-256: 9dc58270f79c20e9faa87e61f7c57c3c7481ea550cbdacb65dd87bca957560e3
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d5f3-3967-77ca-8c6d-ff08c3c0f3fa.png
  Captured: 2026-09-25 00:24:48 UTC
  Source report: https://urlscan.io/result/01a0d5f3-3967-77ca-8c6d-ff08c3c0f3fa/
  SHA-256: 10b08919c07d569c4b7a56734a20731de450a5513cda9bef74e21143a742db43

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:28Z",
        "uuid": "01a0d5f2-3513-7768-b751-3ce5b1ca3978",
        "scanned_at": "2026-09-25T00:23:43Z",
        "final_url": "https://kraken-ssilka-slon.ru/",
        "status": 200,
        "ip": "104.21.88.28",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru",
            "static.cloudflareinsights.com",
            "mdd.yandex.net",
            "hdrc.yandex.net"
        ],
        "ips": [
            "87.250.250.119",
            "87.250.251.119",
            "104.16.80.73",
            "104.21.88.28"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "xn--sln18-vta.cc",
            "krakenu6upk4yrcys6nv25du7ntl7inovhnepkevynfdgkjekkklrgqd.onion"
        ],
        "doc_hash": "1f5778de334ecaec297ab33f0dc3e0ab7eca348a088526e35cad0773a0d3a2cc",
        "script_hashes": [
            "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "requestResize",
            "ym",
            "_wpemojiSettings",
            "__cfBeacon",
            "twemoji",
            "wp",
            "Ya",
            "yaCounter112384039",
            "dataLayer"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "_ym_isad",
            "sync_cookie_csrf",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc",
            "mdd"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_ymBRC",
            "_ym_synced",
            "_ym112384039_lsid",
            "_ym112384039:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "*.kraken-ssilka-slon.ru",
                "kraken-ssilka-slon.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "kraken-ssilka-slon.ru",
            "protocol": "QUIC",
            "valid_to": "2026-11-03T14:05:16Z",
            "valid_from": "2026-08-05T14:05:17Z"
        },
        "domain_age_days": 168,
        "apex_age_days": 168,
        "tls_age_days": 50,
        "tls_valid_days": 89,
        "requests": 52,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 85,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:44Z",
        "uuid": "b146a6cd-f421-4ba4-9522-1a9b574ac4db",
        "scanned_at": "2026-09-25T00:24:31Z",
        "final_url": "https://kraken-ssilka-slon.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://kraken-ssilka-slon.ru/",
                "status": 200
            }
        ],
        "dom_hash": "6b0bb1a7e3f0c7e6014d8e8568877f8817fbc5aa023ba2be771fcfecc75d3e6d",
        "doc_hash": "1f5778de334ecaec297ab33f0dc3e0ab7eca348a088526e35cad0773a0d3a2cc",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "kraken-ssilka-slon.ru",
                "type": "A",
                "value": "104.21.88.28"
            },
            {
                "name": "kraken-ssilka-slon.ru",
                "type": "A",
                "value": "172.67.171.253"
            },
            {
                "name": "kraken-ssilka-slon.ru",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:581c"
            },
            {
                "name": "kraken-ssilka-slon.ru",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:abfd"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.88.28",
        "whois": {
            "registrar": "RU-CENTER-RU",
            "created": "2026-04-08T09:32:18Z",
            "expires": "2027-04-08T09:32:18Z",
            "nameservers": [
                "arch.ns.cloudflare.com",
                "eve.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:34:03Z",
        "analysis_at": "2026-10-05T03:37:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-04-08T00:00:00Z",
        "first_seen": "2026-04-09T09:41:15Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.88.28"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "google-site-verification=ctM9ZPZfE8wmY3cqU3krlFZ1Sgtm2WgP-RW4nQ3Lofs"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:abfd"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:581c"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "arch.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "arch.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.171.253"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "eve.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-05T04:25:02Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.kraken-ssilka-slon.ru",
                "kraken-ssilka-slon.ru"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5d347a8fa531ee1590d5b47c34f272420eb",
            "sha256": "2fc00f13f0c6484300ed1164af5466bda430d6b114e3ce442c954f49a6b8d71c",
            "subject": "kraken-ssilka-slon.ru",
            "valid_to": "2027-01-01T17:45:01Z",
            "valid_from": "2026-10-03T17:45:02Z"
        }
    }
}
```