# PhishDestroy domain threat record: slon6.id

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/slon6.id/
Machine-readable companion: https://phishdestroy.io/domain/slon6.id/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-14 21:22:12 UTC
- Last availability or vendor check: 2026-10-22 10:11:59 UTC
- Stored record updated: 2026-10-22 15:45:10 UTC
- VirusTotal detections in the stored snapshot: 4/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 104.21.88.108
- Registrar in stored WHOIS data: PT Jagoan Hosting Indonesia
- Registrar country in stored WHOIS data: Unknown
- Registration date (registry RDAP, slon6.id): 2026-04-14 08:40:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a1cb-b88a-753c-b0ee-faa509789ff6/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/slon6.id
- Certificate Transparency search: https://crt.sh/?q=%25.slon6.id
- Web Archive lookup: https://web.archive.org/web/*/https://slon6.id/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
slon6.id is a phishing page that uses the Kraken name and opens with a captcha screen titled "Captcha | KRAKEN MARKET | ВХОД НА ДАРКНЕТ САЙТ КРАКЕН". The Russian-language title targets people searching for a way to log in to a site called Kraken. PhishDestroy first detected the domain on 2026-09-14. As of 2026-10-19 the domain still responded, but its DNS no longer pointed to working page content.

How the scam works
The page title presents the site as an entrance to the Kraken darknet market rather than the Kraken cryptocurrency exchange, while we classified it as Kraken impersonation. Lookalike login gateways of this kind usually show a fake captcha first, so the visitor feels they have reached the real entry point. They then present a copied login form. Anything typed there, including usernames, passwords and one-time codes, goes to the operators. Any cryptocurrency sent to deposit addresses shown on the page is lost and cannot be recovered.

Evidence
Detection by independent vendors is low. On 2026-09-27, 4 of 91 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker and SOCRadar. The domain appears in 4 AlienVault OTX threat pulses, so other researchers have also tagged it. PhishDestroy is currently the only blocklist carrying it. Many browsers and security tools may therefore still let users reach it without a warning.

Infrastructure
The domain was registered on 2026-04-14 through PT Jagoan Hosting Indonesia under the Indonesian .id extension. It was detected five months later, which suggests it was registered early and kept in reserve before being put to use. Traffic passes through Cloudflare, Inc. on an address geolocated to Canada. Because Cloudflare acts as a proxy, the server that actually hosts the page is not visible from outside. The short numbered name "slon6" fits a pattern of disposable domains that can be swapped quickly when one gets blocked.

What to do
If you entered a username or password on this page, change it right away on the genuine service and on any other site where you reused it. Then turn on or reset two-factor authentication. Do not send cryptocurrency to any address this page displayed, and treat any balance you already sent as lost. Security teams should block slon6.id at DNS and proxy level and watch for sibling domains with similar numbered names. Abuse reports to Cloudflare and to the registrar can help get the domain taken down.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a1cb-b88a-753c-b0ee-faa509789ff6/
VirusTotal report: https://www.virustotal.com/gui/domain/slon6.id
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=slon6.id
Archived copy: https://web.archive.org/web/20260914212442/https://slon6.id/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:42:30 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/934YRD50/7a37ba4f3a75.png
  Captured: 2026-09-14 21:22:12 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0a1cb-b88a-753c-b0ee-faa509789ff6.png
  Captured: 2026-09-14 21:22:12 UTC
  Source report: https://urlscan.io/result/01a0a1cb-b88a-753c-b0ee-faa509789ff6/
- URLQuery: https://screenshots.phishdestroy.io/uq/f40e35f5-f496-43e9-b761-951c3e5332f2.png
  Captured: 2026-09-14 21:22:55 UTC
  Source report: https://urlquery.net/report/f40e35f5-f496-43e9-b761-951c3e5332f2
  SHA-256: 053f311655afac59c232894ac972f80a5ac7276a364e2e817ae05b130becdf99
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5b1b1f0c-d457-4257-ab23-9645932e4c2b.png
  Captured: 2026-09-14 21:54:59 UTC
  Source report: https://radar.cloudflare.com/scan/5b1b1f0c-d457-4257-ab23-9645932e4c2b
  SHA-256: 97e943c1dc42ddb6fe78d2d4fdecdbb321ced8c4d7f21c4dcc22118fa421d75e
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a1cf-feda-730a-9199-b5547126df26.png
  Captured: 2026-09-14 21:26:05 UTC
  Source report: https://urlscan.io/result/01a0a1cf-feda-730a-9199-b5547126df26/
  SHA-256: eb9f836e90292741c8e7686a682c35df2cea3f0ee20b477ca7e44fc2e2cbc174

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:14:02Z",
        "uuid": "01a0a1cb-b88a-753c-b0ee-faa509789ff6",
        "scanned_at": "2026-09-14T21:21:25Z",
        "final_url": "https://slon6.id/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://slon6.id/",
                "from": "http://slon6.id/",
                "status": 307
            },
            {
                "to": "https://slon6.id/",
                "from": "https://slon6.id/"
            }
        ],
        "ip": "172.67.176.230",
        "ips": [
            "172.67.176.230"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "e1c831f821121942bcf451bd77649b0cba6d0400032ab3245147ba6ec30b9ac9",
        "script_hashes": [
            "10a50430d5ba794708dc4279299ca9c73e281ab09fe2847e2b55f68c21177cc8"
        ],
        "globals": [
            "slowAES",
            "toNumbers",
            "toHex",
            "a",
            "b",
            "c"
        ],
        "cookies": [
            "check_bot",
            "kraken_pm",
            "TCK"
        ],
        "tls": {
            "san": [
                "slon6.id",
                "*.slon6.id"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "slon6.id",
            "protocol": "QUIC",
            "valid_to": "2026-11-12T14:18:30Z",
            "valid_from": "2026-08-14T13:19:57Z"
        },
        "domain_age_days": 31,
        "apex_age_days": 31,
        "tls_age_days": 31,
        "tls_valid_days": 90,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.5.0",
            "strict-transport-security": "max-age=15552000; includeSubDomains; preload"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:25:23Z",
        "uuid": "5b1b1f0c-d457-4257-ab23-9645932e4c2b",
        "scanned_at": "2026-09-14T21:54:59Z",
        "final_url": "https://slon6.id/",
        "status": 200,
        "history": [
            {
                "url": "https://slon6.id/",
                "status": 200
            },
            {
                "url": "https://slon6.id/",
                "status": 200
            },
            {
                "url": "https://slon6.id/",
                "status": 200
            }
        ],
        "dom_hash": "0c5b87dccedda8936e1089e2cf7a46f0ec1fcdc68f08fcec260d7c4ac631c4b5",
        "doc_hash": "72848a20c02da99667e164a4f4e729cb5c38ae55c4389aa2b8bef304292d599f",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "slon6.id",
                "type": "A",
                "value": "104.21.88.108"
            },
            {
                "name": "slon6.id",
                "type": "A",
                "value": "172.67.176.230"
            },
            {
                "name": "slon6.id",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:b0e6"
            },
            {
                "name": "slon6.id",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:586c"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.88.108",
        "whois": {
            "registrar": "PT Jagoan Hosting Indonesia",
            "created": "2026-04-14T08:40:00Z",
            "updated": "2026-08-14T14:15:30Z",
            "expires": "2027-04-14T23:59:59Z",
            "nameservers": [
                "kyle.ns.cloudflare.com",
                "sara.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:54:56Z",
        "analysis_at": "2026-10-05T03:33:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 4,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-06-22T01:43:45Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:b0e6"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "kyle.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.176.230"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:586c"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sara.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.88.108"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kyle.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-09-27T02:00:45Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "slon6.id",
                "*.slon6.id"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "c0d4210e86e8d9870ecb2c185c886399",
            "sha256": "73618bfedc8ae00d4df62b4e7ee0ce431cbfcaca1f217f34620aef6da8fe4dba",
            "subject": "slon6.id",
            "valid_to": "2026-11-12T14:18:30Z",
            "valid_from": "2026-08-14T13:19:57Z"
        }
    }
}
```