# PhishDestroy domain threat record: krmp-kraken-cc.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/krmp-kraken-cc.ru/
Machine-readable companion: https://phishdestroy.io/domain/krmp-kraken-cc.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-24 20:29:04 UTC
- Last availability or vendor check: 2026-10-22 10:29:29 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 5/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 172.67.161.89
- Registrar in stored WHOIS data: RU-CENTER-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-05-26 04:18:37 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d51c-9537-76b8-9357-70cee42bef28/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/krmp-kraken-cc.ru
- Certificate Transparency search: https://crt.sh/?q=%25.krmp-kraken-cc.ru
- Web Archive lookup: https://web.archive.org/web/*/https://krmp-kraken-cc.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
krmp-kraken-cc.ru is an impersonation phishing page that uses the Kraken name. It targets Russian-speaking users looking for a working way into Kraken's onion service. Its title reads "Официальное зеркало Kraken Onion через Tor. Безопасный вход.", which promises an official Tor mirror with a safe login. PhishDestroy first flagged the domain on 2026-09-24, and it was still online and serving content on 2026-10-19.

How the scam works
Fake mirror sites exploit how hard it is to find a genuine onion address. Users search the regular web for a "mirror", land on a lookalike domain and are shown a familiar login form. Anything typed there, including username, password and any one-time code, goes to the operators. They can then log in to the real account, empty crypto balances, or swap in their own deposit addresses so future top-ups go straight to them. The "secure login" wording in the title is there to lower the visitor's guard at exactly the moment credentials are entered.

Evidence
On 2026-10-06, VirusTotal showed 5 of 91 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a low hit rate, so many browsers and security tools will still open the page without a warning. The domain also appears in 4 AlienVault OTX threat pulses, which shows other researchers have tied it to malicious activity. PhishDestroy's blocklist is currently the only list carrying it.

Infrastructure
The domain was registered through RU-CENTER-RU on 2026-05-26, about four months before PhishDestroy detected it. It sits behind Cloudflare, Inc., resolving to 172.67.161.89 with a Canadian edge location. That hides where the page is actually hosted. Its Let's Encrypt certificate gives it the padlock icon, but this says nothing about who runs the site.

What to do
If you entered credentials on this page, change your Kraken password right away from a source you trust, enable or reset two-factor authentication, and sign out all active sessions. Check your account for withdrawals or changed deposit addresses. Do not trust any address you copied from this site. Never reach onion services through search results or "mirror" domains on the regular web. Defenders should block krmp-kraken-cc.ru and look for other domains combining "krmp" and "kraken" in Russian-language traffic. Abuse reports can go to Cloudflare and RU-CENTER.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d51c-9537-76b8-9357-70cee42bef28/
VirusTotal report: https://www.virustotal.com/gui/domain/krmp-kraken-cc.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=krmp-kraken-cc.ru
Archived copy: https://web.archive.org/web/20260924203048/https://krmp-kraken-cc.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:59 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gM84MvD5/276920783805.png
  Captured: 2026-09-24 20:31:11 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d51c-9537-76b8-9357-70cee42bef28.png
  Captured: 2026-09-24 20:31:11 UTC
  Source report: https://urlscan.io/result/01a0d51c-9537-76b8-9357-70cee42bef28/
- URLScan capture 2: https://urlscan.io/screenshots/01a0d292-a2f2-745d-bc02-1157eef56ae7.png
  Captured: 2026-09-24 20:29:04 UTC
  Source report: https://urlscan.io/result/01a0d51c-9537-76b8-9357-70cee42bef28/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/56f183c5-3680-4fa5-8bce-aacce16bd639.png
  Captured: 2026-09-24 20:30:53 UTC
  Source report: https://radar.cloudflare.com/scan/56f183c5-3680-4fa5-8bce-aacce16bd639
  SHA-256: 9dc58270f79c20e9faa87e61f7c57c3c7481ea550cbdacb65dd87bca957560e3
- URLScan · 2026-07-27: https://screenshots.phishdestroy.io/us/019fa1da-cef8-720a-abd6-a22b0978b050.png
  Captured: 2026-07-27 04:35:17 UTC
  Source report: https://urlscan.io/result/019fa1da-cef8-720a-abd6-a22b0978b050/
  SHA-256: c783014845950ac689040e2b52915fb90aaa19fe55dc7aec808c54891149f661
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d292-a2f2-745d-bc02-1157eef56ae7.png
  Captured: 2026-09-24 08:40:28 UTC
  Source report: https://urlscan.io/result/01a0d292-a2f2-745d-bc02-1157eef56ae7/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d51d-d518-77bf-ae73-ec7e73ea5dea.png
  Captured: 2026-09-24 20:31:43 UTC
  Source report: https://urlscan.io/result/01a0d51d-d518-77bf-ae73-ec7e73ea5dea/
  SHA-256: 10b08919c07d569c4b7a56734a20731de450a5513cda9bef74e21143a742db43

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:55Z",
        "uuid": "01a0d51c-9537-76b8-9357-70cee42bef28",
        "scanned_at": "2026-09-24T20:30:26Z",
        "final_url": "https://krmp-kraken-cc.ru/",
        "status": 200,
        "ip": "172.67.161.89",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "87.250.250.119",
            "104.16.80.73",
            "172.67.161.89"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "xn--sln18-vta.cc",
            "krakenu6upk4yrcys6nv25du7ntl7inovhnepkevynfdgkjekkklrgqd.onion"
        ],
        "doc_hash": "103824927402162973b3bd71ab6b842ad1f79ccae6bde0035c987fadd5335a50",
        "script_hashes": [
            "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "requestResize",
            "ym",
            "_wpemojiSettings",
            "__cfBeacon",
            "twemoji",
            "wp",
            "Ya",
            "yaCounter112384039",
            "dataLayer"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_ymBRC",
            "_ym_synced",
            "_ym112384039_lsid",
            "_ym112384039:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "*.krmp-kraken-cc.ru",
                "krmp-kraken-cc.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "krmp-kraken-cc.ru",
            "protocol": "QUIC",
            "valid_to": "2026-12-23T12:36:35Z",
            "valid_from": "2026-09-24T12:36:36Z"
        },
        "domain_age_days": 118,
        "apex_age_days": 118,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 50,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 86,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:58Z",
        "uuid": "56f183c5-3680-4fa5-8bce-aacce16bd639",
        "scanned_at": "2026-09-24T20:30:53Z",
        "final_url": "https://krmp-kraken-cc.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://krmp-kraken-cc.ru/",
                "status": 200
            }
        ],
        "dom_hash": "efd67b019adbb00d6f5e21ab1ceedf6ab75294c607fde5af62caff68d8c10e00",
        "doc_hash": "44b437d735d4c1cb4d80050e9e44ef758ebfdc66f6abc48e2dab63c1669a1f84",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "krmp-kraken-cc.ru",
                "type": "A",
                "value": "172.67.161.89"
            },
            {
                "name": "krmp-kraken-cc.ru",
                "type": "A",
                "value": "104.21.9.218"
            },
            {
                "name": "krmp-kraken-cc.ru",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:9da"
            },
            {
                "name": "krmp-kraken-cc.ru",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:a159"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.161.89",
        "whois": {
            "registrar": "RU-CENTER-RU",
            "created": "2026-05-26T06:18:37Z",
            "expires": "2027-05-26T06:18:37Z",
            "nameservers": [
                "amos.ns.cloudflare.com",
                "kay.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:35:31Z",
        "analysis_at": "2026-10-15T20:26:46Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Dr.Web": "drugs",
            "alphaMountain.ai": "Business/Economy, Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "RU-CENTER-RU",
        "first_seen": "2026-05-27T09:01:07Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:9da"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kay.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.161.89"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:a159"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "amos.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "yandex-verification: 47edb2f14c90ec76"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.9.218"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "amos.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=oRtPcQvTAemd9B1B6YdnlCjrEZ506fVvwb7xWK0b4wg"
            }
        ],
        "dns_at": "2026-10-15T20:54:47Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.krmp-kraken-cc.ru",
                "krmp-kraken-cc.ru"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "57e4929f62d6d2c913a6ca9d186d885b9b3",
            "sha256": "d802dbd29c84b05f2db75b117f7d96f038935e2f1ff2a21483c43de5a6bc213a",
            "subject": "krmp-kraken-cc.ru",
            "valid_to": "2026-12-23T12:36:35Z",
            "valid_from": "2026-09-24T12:36:36Z"
        },
        "whois": {
            "registrar": "RU-CENTER-RU"
        }
    }
}
```