# PhishDestroy domain threat record: kraken-ssilka.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/kraken-ssilka.ru/
Machine-readable companion: https://phishdestroy.io/domain/kraken-ssilka.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-24 23:29:32 UTC
- Last availability or vendor check: 2026-10-22 10:29:28 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 10/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: RU-CENTER-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-20 08:53:27 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d5c1-a6fc-714c-88c8-f4fc11c07487/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/kraken-ssilka.ru
- Certificate Transparency search: https://crt.sh/?q=%25.kraken-ssilka.ru
- Web Archive lookup: https://web.archive.org/web/*/https://kraken-ssilka.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
kraken-ssilka.ru is a Russian-language phishing page that impersonates Kraken. The domain name roughly means "Kraken link," and the page presents itself as a trusted gateway to Kraken. It targets Russian-speaking users who search for a working Kraken address. PhishDestroy first flagged it on 2026-09-25, and it was still online and serving live content on 2026-10-19.

How the scam works
The page title reads "Официальное зеркало Kraken Onion через Tor. Безопасный вход." ("Official Kraken Onion mirror via Tor. Secure login."). That title points to a Tor-based Kraken service rather than the Kraken exchange, while we classify the site as Kraken impersonation phishing. Fake "official mirror" pages like this one exploit users who cannot easily verify which address is genuine. The page offers a familiar-looking sign-in form, and whatever username, password or one-time code the visitor enters goes straight to the operators. With those credentials, the operators can take over the account and drain its balance, and any funds a victim deposits through such a page are sent to the scammers.

Evidence
On 2026-10-07, VirusTotal showed 10 of 92 engines flagging the domain. The named vendors are alphaMountain.ai, BitDefender, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft and SOCRadar. That is moderate coverage, so many browsers and security tools may still let the page load without a warning. The domain also appears in four AlienVault OTX threat pulses and on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-04-20 through RU-CENTER, roughly five months before PhishDestroy detected it. It has a long run of quiet operation behind it rather than a throwaway, same-week launch. Traffic passes through Cloudflare on an address geolocated to Canada, which hides the real origin server from visitors. The Let's Encrypt certificate gives the page a padlock, but that only means the connection is encrypted, not that the site is legitimate.

What to do
If you signed in on this page, change your Kraken password immediately from a trusted bookmark. Reset two-factor authentication, end all active sessions, and check your login history and withdrawal settings for changes. Change the password anywhere else you reused it, and do not send any further funds through addresses obtained from this site. Security teams should block kraken-ssilka.ru at DNS and proxy level and report it to Cloudflare and RU-CENTER for takedown. They should also watch for similar "ssilka" or "mirror" lookalike domains reaching their users.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d5c1-a6fc-714c-88c8-f4fc11c07487/
VirusTotal report: https://www.virustotal.com/gui/domain/kraken-ssilka.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kraken-ssilka.ru
Archived copy: https://web.archive.org/web/20260924232953/https://kraken-ssilka.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:48 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gM84MvD5/276920783805.png
  Captured: 2026-09-24 23:31:25 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d5c1-a6fc-714c-88c8-f4fc11c07487.png
  Captured: 2026-09-24 23:31:25 UTC
  Source report: https://urlscan.io/result/01a0d5c1-a6fc-714c-88c8-f4fc11c07487/
- URLScan capture 2: https://urlscan.io/screenshots/01a00fe5-5bfe-70cc-aae2-29f3f30bcfd9.png
  Captured: 2026-09-24 23:29:32 UTC
  Source report: https://urlscan.io/result/01a0d5c1-a6fc-714c-88c8-f4fc11c07487/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/bde0639c-2717-4905-aea0-5ec9ebbe1f07.png
  Captured: 2026-09-24 23:32:29 UTC
  Source report: https://radar.cloudflare.com/scan/bde0639c-2717-4905-aea0-5ec9ebbe1f07
  SHA-256: 9dc58270f79c20e9faa87e61f7c57c3c7481ea550cbdacb65dd87bca957560e3
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d5c4-90fe-708f-8ab7-fe5bf0e81b15.png
  Captured: 2026-09-24 23:33:50 UTC
  Source report: https://urlscan.io/result/01a0d5c4-90fe-708f-8ab7-fe5bf0e81b15/
  SHA-256: 10b08919c07d569c4b7a56734a20731de450a5513cda9bef74e21143a742db43
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a1491b-6d9f-729d-a9af-e59ed10ada7e.png
  Captured: 2026-10-17 09:05:03 UTC
  Source report: https://urlscan.io/result/01a1491b-6d9f-729d-a9af-e59ed10ada7e/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14e04-ba5a-773d-a42a-a6c2e50bf8b8.png
  Captured: 2026-10-18 07:58:24 UTC
  Source report: https://urlscan.io/result/01a14e04-ba5a-773d-a42a-a6c2e50bf8b8/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14e33-dd55-7320-9658-42a47430876b.png
  Captured: 2026-10-18 08:49:51 UTC
  Source report: https://urlscan.io/result/01a14e33-dd55-7320-9658-42a47430876b/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14e81-ab43-71ed-a37a-527ef9d0b63b.png
  Captured: 2026-10-18 10:14:50 UTC
  Source report: https://urlscan.io/result/01a14e81-ab43-71ed-a37a-527ef9d0b63b/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:36Z",
        "uuid": "01a0d5c1-a6fc-714c-88c8-f4fc11c07487",
        "scanned_at": "2026-09-24T23:30:39Z",
        "final_url": "https://kraken-ssilka.ru/",
        "status": 200,
        "ip": "188.114.97.3",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru"
        ],
        "ips": [
            "77.88.21.119",
            "188.114.97.3"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "xn--sln18-vta.cc",
            "krakenu6upk4yrcys6nv25du7ntl7inovhnepkevynfdgkjekkklrgqd.onion"
        ],
        "doc_hash": "2c65811175d6d02ec2c52ff8c654daffe0315c26231b78c341623ee080fe35c6",
        "script_hashes": [
            "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "requestResize",
            "ym",
            "_wpemojiSettings",
            "twemoji",
            "wp",
            "Ya",
            "yaCounter112384039",
            "dataLayer"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "_yasc",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_ymBRC",
            "_ym_synced",
            "_ym112384039_lsid",
            "_ym112384039:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "*.kraken-ssilka.ru",
                "kraken-ssilka.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "kraken-ssilka.ru",
            "protocol": "QUIC",
            "valid_to": "2026-11-15T15:42:35Z",
            "valid_from": "2026-08-17T15:42:36Z"
        },
        "domain_age_days": 575,
        "apex_age_days": 575,
        "tls_age_days": 38,
        "tls_valid_days": 89,
        "requests": 46,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 65,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:50Z",
        "uuid": "bde0639c-2717-4905-aea0-5ec9ebbe1f07",
        "scanned_at": "2026-09-24T23:32:29Z",
        "final_url": "https://kraken-ssilka.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://kraken-ssilka.ru/",
                "status": 200
            }
        ],
        "dom_hash": "237c7b243dad80db458c4aff5eb6a18b57aeaa9044ba9805ccdd2187a959d649",
        "doc_hash": "2dcef8571a4b1af6ef23f6df866d804b32130dfbfd4cd48e8b59eafd490f1358",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "kraken-ssilka.ru",
                "type": "A",
                "value": "104.21.51.50"
            },
            {
                "name": "kraken-ssilka.ru",
                "type": "A",
                "value": "172.67.221.105"
            },
            {
                "name": "kraken-ssilka.ru",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:3332"
            },
            {
                "name": "kraken-ssilka.ru",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:dd69"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.51.50",
        "whois": {
            "registrar": "RU-CENTER-RU",
            "created": "2026-04-20T10:53:27Z",
            "expires": "2027-04-20T10:53:27Z",
            "nameservers": [
                "igor.ns.cloudflare.com",
                "sloan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:35:05Z",
        "analysis_at": "2026-10-17T19:23:15Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "Gridinsoft": "suspicious"
        },
        "reputation": 0,
        "created": "2026-04-20T00:00:00Z",
        "first_seen": "2025-02-26T15:34:58Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:3332"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.51.50"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.221.105"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:dd69"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "igor.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "igor.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sloan.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-17T19:24:03Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.kraken-ssilka.ru",
                "kraken-ssilka.ru"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "56ddf1c66f6e40e838fefd9a36a493b874e",
            "sha256": "3bec83fe0026fce48bbb9d478445907243d08d2ea8d62a7aded0dc9395f055a9",
            "subject": "kraken-ssilka.ru",
            "valid_to": "2027-01-13T18:32:07Z",
            "valid_from": "2026-10-15T18:32:08Z"
        }
    }
}
```