# PhishDestroy domain threat record: kraken-zerkalo-darknet.ph

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/kraken-zerkalo-darknet.ph/
Machine-readable companion: https://phishdestroy.io/domain/kraken-zerkalo-darknet.ph/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-25 05:21:14 UTC
- Last availability or vendor check: 2026-10-22 10:25:59 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 4/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 45.79.222.138
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a04e1b-c63d-73b3-82e3-f050e305fd34/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/kraken-zerkalo-darknet.ph
- Certificate Transparency search: https://crt.sh/?q=%25.kraken-zerkalo-darknet.ph
- Web Archive lookup: https://web.archive.org/web/*/https://kraken-zerkalo-darknet.ph/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
kraken-zerkalo-darknet.ph is a phishing site that impersonates the Kraken brand. The name combines Kraken with "zerkalo", Russian for "mirror", and "darknet", which pitches it to Russian-speaking users who expect to reach Kraken through alternate mirror addresses. PhishDestroy first saw the domain on 2026-09-25, and it was still online and serving content on 2026-10-19.

How the scam works
Mirror-link scams depend on users not knowing which address is genuine. A search result, forum post or chat message offers a working "mirror", and the victim lands on a page that hands them off to a Kraken lookalike where the login form sends usernames, passwords and one-time codes straight to the operators. With those credentials the attackers can take over the account and empty any balance or crypto held in it. The page title reads "Redirecting...", which shows a forwarding step rather than a branded login page, while our analysis classifies the site as Kraken impersonation phishing.

Evidence
On 2026-10-06, 4 of 91 VirusTotal engines flagged the domain: CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a small share, so most security filters will still let the page load, and a clean result from your own tools does not mean the site is safe. The domain appears in 3 AlienVault OTX threat pulses, and PhishDestroy lists it on its blocklist.

Infrastructure
The site runs on Akamai Connected Cloud at 45.79.222.138 in the United States. That is shared commercial cloud hosting, so the IP address may also serve unrelated sites. The certificate comes from Let's Encrypt, which gives the page a browser padlock for free. The padlock only means the connection is encrypted and says nothing about whether the site is the real Kraken.

What to do
If you entered a username, password or 2FA code here, change the password on the real service right away and on any other site where you used it. Then reset two-factor authentication and review recent logins, sessions and withdrawals. Do not use "mirror" links from search results or chats, and type the official address yourself. Security teams should block kraken-zerkalo-darknet.ph at DNS and proxy level and filter messages that promote Kraken mirror links. Because the IP sits on shared cloud hosting, block the domain rather than the address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a04e1b-c63d-73b3-82e3-f050e305fd34/
VirusTotal report: https://www.virustotal.com/gui/domain/kraken-zerkalo-darknet.ph
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kraken-zerkalo-darknet.ph
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:43 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a04e1b-c63d-73b3-82e3-f050e305fd34.png
  Captured: 2026-09-25 05:21:14 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a04e1b-c63d-73b3-82e3-f050e305fd34.png
  Captured: 2026-09-26 03:30:16 UTC
  Source report: https://urlscan.io/result/01a04e1b-c63d-73b3-82e3-f050e305fd34/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2394944e-e0e9-4899-b6fe-502a6bfe8690.png
  Captured: 2026-09-25 05:23:10 UTC
  Source report: https://radar.cloudflare.com/scan/2394944e-e0e9-4899-b6fe-502a6bfe8690
  SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66
- URLScan · 2026-08-27: https://screenshots.phishdestroy.io/us/01a042df-d6f8-71fe-93ea-6769c4e2dc6a.png
  Captured: 2026-08-27 10:59:26 UTC
  Source report: https://urlscan.io/result/01a042df-d6f8-71fe-93ea-6769c4e2dc6a/
  SHA-256: e1c3fdc22b685b2cfbd7745fbc3b0301ab5dbef448a8858ae94cf7248a8302b6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:58:43Z",
        "uuid": "01a04e1b-c63d-73b3-82e3-f050e305fd34",
        "scanned_at": "2026-08-29T15:20:43Z",
        "final_url": "https://www.kraken-zerkalo-darknet.ph/",
        "status": 200,
        "ip": "45.79.222.138",
        "ptr": "45-79-222-138.ip.linodeusercontent.com",
        "domains": [
            "parking3.parklogic.com",
            "router.parklogic.com"
        ],
        "ips": [
            "2600:3c06::f03c:95ff:fed9:ce5e",
            "172.234.216.100",
            "45.79.222.138"
        ],
        "asns": [
            "63949"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.dot.ph",
            "adorarama.com",
            "parklogic.com"
        ],
        "doc_hash": "1a1dc0d6f3fd935ca36bd8075c39732e1d37a75c68717d1de3c693113075bf66",
        "globals": [
            "plBanner"
        ],
        "tls": {
            "san": [
                "www.kraken-zerkalo-darknet.ph"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "www.kraken-zerkalo-darknet.ph",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-27T13:31:46Z",
            "valid_from": "2026-08-29T13:31:47Z"
        },
        "domain_age_days": 68,
        "apex_age_days": 68,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -66,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "openresty",
            "content-type": "text/html",
            "permissions-policy": "ch-ua=(self \"https://*.parklogic.com\"), ch-ua-arch=(self \"https://*.parklogic.com\"), ch-ua-bitness=(self \"https://*.parklogic.com\"), ch-ua-full-version=(self \"https://*.parklogic.com\"), ch-ua-full-ver"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:05Z",
        "uuid": "2394944e-e0e9-4899-b6fe-502a6bfe8690",
        "scanned_at": "2026-09-25T05:23:10Z",
        "final_url": "https://kraken-zerkalo-darknet.ph/",
        "history": [
            {
                "url": "https://kraken-zerkalo-darknet.ph/",
                "status": 0
            }
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "kraken-zerkalo-darknet.ph",
                "type": "A",
                "value": "45.79.222.138"
            }
        ],
        "dnssec_valid": false
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T18:10:22Z",
        "analysis_at": "2026-10-06T02:00:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "first_seen": "2026-06-22T02:51:28Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "A",
                "value": "45.79.222.138"
            }
        ],
        "dns_at": "2026-10-06T02:00:19Z",
        "jarm": "27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5",
        "cert": {
            "san": [
                "kraken-zerkalo-darknet.ph"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "653d16fe3dd44bdda1b8a75c504f3eb8713",
            "sha256": "c48556dff9c85579a34183dc894d17ca52d960d79ab267f76630047cfa85a40f",
            "subject": "kraken-zerkalo-darknet.ph",
            "valid_to": "2026-11-25T09:59:17Z",
            "valid_from": "2026-08-27T09:59:18Z"
        }
    }
}
```