# PhishDestroy domain threat record: mg-market-ssylka.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mg-market-ssylka.ru/
Machine-readable companion: https://phishdestroy.io/domain/mg-market-ssylka.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-09-28 09:33:51 UTC
- Last availability or vendor check: 2026-10-22 11:02:22 UTC
- Stored record updated: 2026-10-22 15:45:53 UTC
- VirusTotal detections in the stored snapshot: 4/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.139.74
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registration date in stored WHOIS data: 2026-03-10 23:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019d00d0-787c-767e-af22-c12f89790779/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mg-market-ssylka.ru
- Certificate Transparency search: https://crt.sh/?q=%25.mg-market-ssylka.ru
- Web Archive lookup: https://web.archive.org/web/*/https://mg-market-ssylka.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
mg-market-ssylka.ru is an impersonation phishing page built around a lure of a "market link." "Ssylka" is Russian for "link," so the domain is aimed at Russian-speaking users searching for a working entry point to a marketplace. PhishDestroy first flagged it on 2026-09-28. As of 2026-10-19 the page content was unreachable and the site's state could not be confirmed.

How the scam works
Link-portal impersonation relies on people who search for a site's "current link" or "mirror" instead of typing a known address. The fake domain presents itself as the genuine gateway, then shows a copied login or account page that captures whatever the visitor enters. Victims typically lose their account credentials, and any balance or funds tied to that account. When last loaded, the page title showed a Cloudflare "523: Origin is unreachable" error rather than impersonation content, while our classification remains impersonation phishing.

Evidence
On 2026-10-01, four of 91 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker and SOCRadar. That is a modest count, but the four vendors are independent and use different detection methods. The domain also appears in two AlienVault OTX threat pulses, which means other researchers have tied it to malicious activity. Among blocklists, it is carried by PhishDestroy.

Infrastructure
The domain resolves to 172.67.139.74 on Cloudflare's network, geolocated to Canada. Because Cloudflare acts as a reverse proxy, that address belongs to Cloudflare and not to the operator, so the real server stays hidden. The 523 error means Cloudflare could not reach the origin behind it. The site uses a free automated certificate from the E7 issuer, so its padlock only shows the connection is encrypted and says nothing about whether the site is legitimate.

What to do
If you entered a username or password here, change it right away on the real service and on any other site where you reuse it. Turn on two-factor authentication and review recent logins, sessions and balance changes. Open marketplaces only from an address you have already verified, never from search results or link-sharing pages. Defenders should block mg-market-ssylka.ru at DNS and proxy level and check logs for past visits. Reports to Cloudflare can help get the hidden origin server traced and taken down.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019d00d0-787c-767e-af22-c12f89790779/
VirusTotal report: https://www.virustotal.com/gui/domain/mg-market-ssylka.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mg-market-ssylka.ru
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:27 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019d00d0-787c-767e-af22-c12f89790779.png
  Captured: 2026-09-28 09:33:51 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/14fb877d-2185-42eb-85df-627c869132d1.png
  Captured: 2026-09-28 09:37:50 UTC
  Source report: https://radar.cloudflare.com/scan/14fb877d-2185-42eb-85df-627c869132d1
  SHA-256: 63964ad6b8ee0ae2e7a254e90ef73123d216549d899d71b6ea4644cb67463795
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e75d-b471-731a-86c0-c7dff33cd02d.png
  Captured: 2026-09-28 09:34:41 UTC
  Source report: https://urlscan.io/result/01a0e75d-b471-731a-86c0-c7dff33cd02d/
  SHA-256: b2cd3aa4fa599048f34a0de9a5a9085bc7f6b6558d84692c3f41032fb4245dce
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e760-0348-74b1-b5be-1d36390229b0.png
  Captured: 2026-09-28 09:37:10 UTC
  Source report: https://urlscan.io/result/01a0e760-0348-74b1-b5be-1d36390229b0/
  SHA-256: 9692b1731a5448f1e5c7485be755869996625d0dec24f4fce49537cbe3dfe945
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e760-1dfc-7409-ba82-5420c08c8fc5.png
  Captured: 2026-09-28 09:37:17 UTC
  Source report: https://urlscan.io/result/01a0e760-1dfc-7409-ba82-5420c08c8fc5/
  SHA-256: 6da2ff365fe177e693f0b69011951b4d49e9d547f3840002e883724957f21597

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:24Z",
        "uuid": "019d00d0-787c-767e-af22-c12f89790779",
        "scanned_at": "2026-03-18T12:00:06Z",
        "final_url": "https://mg-market-ssylka.ru/",
        "status": 200,
        "ip": "172.67.139.74",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru",
            "fonts.gstatic.com",
            "static.cloudflareinsights.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "172.253.115.94",
            "87.250.251.119",
            "104.16.80.73",
            "142.251.163.95",
            "172.67.139.74"
        ],
        "asns": [
            "15169",
            "13238",
            "13335"
        ],
        "countries": [
            "US",
            "RU"
        ],
        "doc_hash": "b40a200f07465b1544d1704e6d36c8b4fc6ccb17e543dcef14f3a5c1333ca1a5",
        "globals": [
            "ym",
            "__cfBeacon",
            "Ya",
            "yaCounter106507079",
            "dataLayer"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "_ym_isad",
            "sync_cookie_csrf",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "receive-cookie-deprecation"
        ],
        "storage_keys": [
            "_ymBRC",
            "_ym_synced",
            "_ym106507079_lsid",
            "_ym106507079:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs"
        ],
        "tls": {
            "san": [
                "*.mg-market-ssylka.ru",
                "mg-market-ssylka.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "E7",
            "subject": "mg-market-ssylka.ru",
            "protocol": "QUIC",
            "valid_to": "2026-06-09T10:26:31Z",
            "valid_from": "2026-03-11T10:26:32Z"
        },
        "domain_age_days": 7,
        "apex_age_days": 7,
        "tls_age_days": 7,
        "tls_valid_days": 89,
        "requests": 16,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 80,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:59Z",
        "uuid": "14fb877d-2185-42eb-85df-627c869132d1",
        "scanned_at": "2026-09-28T09:37:50Z",
        "final_url": "https://mg-market-ssylka.ru/",
        "status": 523,
        "history": [
            {
                "url": "https://mg-market-ssylka.ru/",
                "status": 523
            }
        ],
        "dom_hash": "44f83b86670a53701e60f71195a3f41260783e3e1297f0ec6a48f6f4d16a372e",
        "doc_hash": "fbac9d1fa05d271713e9b41a6c8b588ee7e5e01d6d6fd3f8f7468cad872c6ad9",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mg-market-ssylka.ru",
                "type": "A",
                "value": "172.67.139.74"
            },
            {
                "name": "mg-market-ssylka.ru",
                "type": "A",
                "value": "104.21.70.205"
            },
            {
                "name": "mg-market-ssylka.ru",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:46cd"
            },
            {
                "name": "mg-market-ssylka.ru",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:8b4a"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.139.74",
        "whois": {
            "registrar": "REGRU-RU",
            "created": "2026-03-11T08:41:45Z",
            "expires": "2027-03-11T08:41:45Z",
            "nameservers": [
                "brenna.ns.cloudflare.com",
                "louis.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:44:34Z",
        "analysis_at": "2026-10-15T21:08:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 3,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "suspicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Dr.Web": "drugs",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-03-11T00:00:00Z",
        "first_seen": "2026-03-11T11:42:13Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:46cd"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.70.205"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "louis.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "brenna.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.139.74"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:8b4a"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "brenna.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-15T23:28:08Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.mg-market-ssylka.ru",
                "mg-market-ssylka.ru"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5a144ec3965e9533294eed412a0a306c403",
            "sha256": "618691461b8f55d1ebb923890db4717c76cb96c4d0d7354a6b4955ecc977c5f3",
            "subject": "mg-market-ssylka.ru",
            "valid_to": "2026-12-03T21:24:38Z",
            "valid_from": "2026-09-04T21:24:39Z"
        }
    }
}
```