# PhishDestroy domain threat record: ssilka-kraken.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ssilka-kraken.ru/
Machine-readable companion: https://phishdestroy.io/domain/ssilka-kraken.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-24 23:32:07 UTC
- Last availability or vendor check: 2026-10-22 10:33:55 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 5/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: RU-CENTER-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-20 08:53:15 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d5c4-57bb-72f6-b094-2943ca8c5064/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ssilka-kraken.ru
- Certificate Transparency search: https://crt.sh/?q=%25.ssilka-kraken.ru
- Web Archive lookup: https://web.archive.org/web/*/https://ssilka-kraken.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
ssilka-kraken.ru is an impersonation phishing page that trades on the Kraken name. The domain is transliterated Russian for "Kraken link," and it is aimed at Russian-speaking users searching for a working Kraken address. PhishDestroy first flagged it on 2026-09-25. As of 2026-10-19 the site was still online and serving its content.

How the scam works
The page title reads "Официальное зеркало Kraken Onion через Tor. Безопасный вход.", which translates to "Official Kraken Onion mirror via Tor. Secure login." Lookalike "mirror" sites like this rely on users who cannot easily verify a link and assume that a search result or a forwarded address is genuine. The visitor is shown a familiar-looking login form or an address to visit next. The username and password typed in go straight to the operators, who can use them to empty the real account. Some of these pages also ask for a deposit, so the money is sent to an address the scammers control.

Evidence
On 2026-10-06, 5 of 91 VirusTotal engines flagged the domain as malicious: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That count is modest, so many browsers and security tools will still open the page without a warning. The domain appears in four AlienVault OTX threat pulses, which shows other researchers are tracking it. It is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-04-20 through RU-CENTER-RU, about five months before PhishDestroy detected it. That gap left it a long window to build search visibility before anyone flagged it. The site sits behind Cloudflare at 188.114.97.3, which geolocates to Canada. That address belongs to Cloudflare's network and reveals nothing about where the real server is located.

What to do
If you entered a login on this page, change that password immediately from a link you trust, and change it anywhere else you reused it. Turn on app-based two-factor authentication and review recent logins and withdrawals on the genuine account. Do not send any deposit, and treat any payment already made as lost to the operators. Reach the real service only through a bookmarked or independently verified address, never through a "mirror" from a search result or a chat. Defenders should block ssilka-kraken.ru at DNS and the web proxy and watch for similar transliterated Kraken lookalikes on the .ru zone.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d5c4-57bb-72f6-b094-2943ca8c5064/
VirusTotal report: https://www.virustotal.com/gui/domain/ssilka-kraken.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ssilka-kraken.ru
Archived copy: https://web.archive.org/web/20260924233213/https://ssilka-kraken.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:46 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/KxDmhGcN/e07187953ae9.png
  Captured: 2026-09-24 23:34:33 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d5c4-57bb-72f6-b094-2943ca8c5064.png
  Captured: 2026-09-24 23:34:33 UTC
  Source report: https://urlscan.io/result/01a0d5c4-57bb-72f6-b094-2943ca8c5064/
- URLScan capture 2: https://urlscan.io/screenshots/01a00f3f-3995-765f-8835-d665f96f3342.png
  Captured: 2026-09-24 23:32:07 UTC
  Source report: https://urlscan.io/result/01a0d5c4-57bb-72f6-b094-2943ca8c5064/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ccd37062-4fef-4a28-9a64-72b88b83477d.png
  Captured: 2026-09-24 23:34:24 UTC
  Source report: https://radar.cloudflare.com/scan/ccd37062-4fef-4a28-9a64-72b88b83477d
  SHA-256: 9dc58270f79c20e9faa87e61f7c57c3c7481ea550cbdacb65dd87bca957560e3
- URLScan · 2026-08-17: https://screenshots.phishdestroy.io/us/01a00f3f-3995-765f-8835-d665f96f3342.png
  Captured: 2026-08-17 10:23:26 UTC
  Source report: https://urlscan.io/result/01a00f3f-3995-765f-8835-d665f96f3342/
  SHA-256: 89eaa5ea5a6c2717a5a32e7d7152a181176f91da39f5815d58926e9624a356a7
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d5c5-58a4-7520-b3c0-879195116a25.png
  Captured: 2026-09-24 23:34:42 UTC
  Source report: https://urlscan.io/result/01a0d5c5-58a4-7520-b3c0-879195116a25/
  SHA-256: 10b08919c07d569c4b7a56734a20731de450a5513cda9bef74e21143a742db43
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14877-9c7c-77c9-b1fe-9b5530e8b93e.png
  Captured: 2026-10-17 06:06:07 UTC
  Source report: https://urlscan.io/result/01a14877-9c7c-77c9-b1fe-9b5530e8b93e/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:37Z",
        "uuid": "01a0d5c4-57bb-72f6-b094-2943ca8c5064",
        "scanned_at": "2026-09-24T23:33:36Z",
        "final_url": "https://ssilka-kraken.ru/",
        "status": 200,
        "ip": "188.114.96.3",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru"
        ],
        "ips": [
            "87.250.251.119",
            "188.114.96.3"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "xn--sln18-vta.cc",
            "krakenu6upk4yrcys6nv25du7ntl7inovhnepkevynfdgkjekkklrgqd.onion"
        ],
        "doc_hash": "b175c1d8c9e5e77362917513beb5bcc28028ffeef256419ad151a9c01928b7de",
        "script_hashes": [
            "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "requestResize",
            "ym",
            "_wpemojiSettings",
            "twemoji",
            "wp",
            "Ya",
            "yaCounter112384039",
            "dataLayer"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_ymBRC",
            "_ym_synced",
            "_ym112384039_lsid",
            "_ym112384039:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "*.ssilka-kraken.ru",
                "ssilka-kraken.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "ssilka-kraken.ru",
            "protocol": "QUIC",
            "valid_to": "2026-11-15T09:22:47Z",
            "valid_from": "2026-08-17T09:22:48Z"
        },
        "domain_age_days": 156,
        "apex_age_days": 156,
        "tls_age_days": 38,
        "tls_valid_days": 89,
        "requests": 46,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 83,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:50Z",
        "uuid": "ccd37062-4fef-4a28-9a64-72b88b83477d",
        "scanned_at": "2026-09-24T23:34:24Z",
        "final_url": "https://ssilka-kraken.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://ssilka-kraken.ru/",
                "status": 200
            }
        ],
        "dom_hash": "237c7b243dad80db458c4aff5eb6a18b57aeaa9044ba9805ccdd2187a959d649",
        "doc_hash": "583def483a4525448fb42ebebd089f2312fde8b62c6fb9584cbffe4b4ba258ae",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ssilka-kraken.ru",
                "type": "A",
                "value": "172.67.211.202"
            },
            {
                "name": "ssilka-kraken.ru",
                "type": "A",
                "value": "104.21.75.39"
            },
            {
                "name": "ssilka-kraken.ru",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:4b27"
            },
            {
                "name": "ssilka-kraken.ru",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:d3ca"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.211.202",
        "whois": {
            "registrar": "RU-CENTER-RU",
            "created": "2026-04-20T10:53:15Z",
            "expires": "2027-04-20T10:53:15Z",
            "nameservers": [
                "igor.ns.cloudflare.com",
                "sloan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:35:07Z",
        "analysis_at": "2026-10-19T13:35:25Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "created": "2026-04-20T00:00:00Z",
        "first_seen": "2026-04-21T11:43:32Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.211.202"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:d3ca"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sloan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:4b27"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.75.39"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "igor.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "igor.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-19T13:50:14Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.ssilka-kraken.ru",
                "ssilka-kraken.ru"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "650307eb6c45f159055277f41557161cba3",
            "sha256": "375e72d624c2912c4042b6bb5e8cf91522447e5e2e8daabeadd7f4e5de486447",
            "subject": "ssilka-kraken.ru",
            "valid_to": "2027-01-13T08:47:12Z",
            "valid_from": "2026-10-15T08:47:13Z"
        }
    }
}
```