# PhishDestroy domain threat record: zerkalo-slon-kraken.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/zerkalo-slon-kraken.ru/
Machine-readable companion: https://phishdestroy.io/domain/zerkalo-slon-kraken.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-24 23:07:06 UTC
- Last availability or vendor check: 2026-10-22 10:34:14 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: RU-CENTER-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-03-12 05:54:15 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d5ac-a8d4-755e-a18a-67c992c561d2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/zerkalo-slon-kraken.ru
- Certificate Transparency search: https://crt.sh/?q=%25.zerkalo-slon-kraken.ru
- Web Archive lookup: https://web.archive.org/web/*/https://zerkalo-slon-kraken.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
zerkalo-slon-kraken.ru is a phishing page that impersonates Kraken. Its Russian page title, "Официальное зеркало Kraken Onion через Tor. Безопасный вход.", promises an "official Kraken Onion mirror via Tor" with a "secure login". The name itself ("zerkalo" means mirror) targets Russian-speaking users who search the open web for a working Kraken mirror. PhishDestroy first saw the domain on 2026-09-25, and it was still online and serving its content on 2026-10-19.

How the scam works
Mirror-phishing sites rely on users who cannot reach a service directly and go looking for an alternate address. The page copies the look of the Kraken login and stresses safety and Tor access to lower the visitor's guard. Whatever is typed into the form, usually a username, password and sometimes a one-time code, goes to the operators. They can use it to take over the real account and empty its balance. Victims typically lose account access and any funds held there, and some are also pushed to send deposits to addresses the scammers control.

Evidence
Six of 92 VirusTotal engines flagged the domain as of 2026-10-07: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. Many engines are still silent, but the flags come from several independent vendors. Spamhaus lists the domain in its DBL with a phishing tag (DBL_PHISH), and four AlienVault OTX threat pulses reference it. PhishDestroy carries it on its blocklist.

Infrastructure
The domain was registered through RU-CENTER-RU on 2026-03-12, more than six months before PhishDestroy flagged it. That long gap fits a domain that was aged or quietly circulated before it drew attention. It resolves to 188.114.97.3 on Cloudflare's network with a Canadian location. This address belongs to Cloudflare's proxy and does not reveal the real server. The site uses a free Let's Encrypt certificate, so the padlock in the browser says nothing about whether the page is legitimate.

What to do
If you entered a login on this page, go to the genuine service through an address you already trust and change your password right away. Change it anywhere else you reused it, enable or reset two-factor authentication, and review recent sessions and withdrawals. Do not send deposits or "verification" payments requested through this site, and never trust mirror links found through search results or chats. Defenders should block the domain at DNS and proxy level and alert on traffic to it. Abuse reports to Cloudflare and RU-CENTER will help get the page taken down.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d5ac-a8d4-755e-a18a-67c992c561d2/
VirusTotal report: https://www.virustotal.com/gui/domain/zerkalo-slon-kraken.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=zerkalo-slon-kraken.ru
Archived copy: https://web.archive.org/web/20260924230744/https://zerkalo-slon-kraken.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:48 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/KxDmhGcN/e07187953ae9.png
  Captured: 2026-09-24 23:08:41 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d5ac-a8d4-755e-a18a-67c992c561d2.png
  Captured: 2026-09-24 23:08:41 UTC
  Source report: https://urlscan.io/result/01a0d5ac-a8d4-755e-a18a-67c992c561d2/
- URLScan capture 2: https://urlscan.io/screenshots/01a07924-c40b-767b-acc4-87437fce08a7.png
  Captured: 2026-09-24 23:07:06 UTC
  Source report: https://urlscan.io/result/01a0d5ac-a8d4-755e-a18a-67c992c561d2/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/79ef96ae-3866-4d6a-ad31-9047f6276f34.png
  Captured: 2026-09-24 23:09:03 UTC
  Source report: https://radar.cloudflare.com/scan/79ef96ae-3866-4d6a-ad31-9047f6276f34
  SHA-256: 9dc58270f79c20e9faa87e61f7c57c3c7481ea550cbdacb65dd87bca957560e3
- URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a07924-c40b-767b-acc4-87437fce08a7.png
  Captured: 2026-09-06 23:54:33 UTC
  Source report: https://urlscan.io/result/01a07924-c40b-767b-acc4-87437fce08a7/
  SHA-256: 614d6d720a0f7cc22cc2038158b22ffcb3f5dc326c498084cb6232f2d527e5c5
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d5b3-5a9b-75ef-9e38-4306adf1f8ec.png
  Captured: 2026-09-24 23:15:05 UTC
  Source report: https://urlscan.io/result/01a0d5b3-5a9b-75ef-9e38-4306adf1f8ec/
  SHA-256: 10b08919c07d569c4b7a56734a20731de450a5513cda9bef74e21143a742db43

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:40Z",
        "uuid": "01a0d5ac-a8d4-755e-a18a-67c992c561d2",
        "scanned_at": "2026-09-24T23:07:44Z",
        "final_url": "https://zerkalo-slon-kraken.ru/",
        "status": 200,
        "ip": "188.114.96.3",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru"
        ],
        "ips": [
            "87.250.251.119",
            "188.114.96.3"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "xn--sln18-vta.cc",
            "krakenu6upk4yrcys6nv25du7ntl7inovhnepkevynfdgkjekkklrgqd.onion"
        ],
        "doc_hash": "ec26c182c4234f89194865e3e7a7c38e9410cc5242d0fc3f60cde64c719faacb",
        "script_hashes": [
            "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "requestResize",
            "ym",
            "_wpemojiSettings",
            "twemoji",
            "wp",
            "Ya",
            "yaCounter112384039",
            "dataLayer"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "_yasc",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_ymBRC",
            "_ym_synced",
            "_ym112384039_lsid",
            "_ym112384039:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "*.zerkalo-slon-kraken.ru",
                "zerkalo-slon-kraken.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "zerkalo-slon-kraken.ru",
            "protocol": "QUIC",
            "valid_to": "2026-12-04T11:17:26Z",
            "valid_from": "2026-09-05T11:17:27Z"
        },
        "domain_age_days": 196,
        "apex_age_days": 196,
        "tls_age_days": 19,
        "tls_valid_days": 89,
        "requests": 46,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 75,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:52Z",
        "uuid": "79ef96ae-3866-4d6a-ad31-9047f6276f34",
        "scanned_at": "2026-09-24T23:09:03Z",
        "final_url": "https://zerkalo-slon-kraken.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://zerkalo-slon-kraken.ru/",
                "status": 200
            }
        ],
        "dom_hash": "6b0bb1a7e3f0c7e6014d8e8568877f8817fbc5aa023ba2be771fcfecc75d3e6d",
        "doc_hash": "f8480d004c86af0df3fa891702577ebd2c0fe9039d756eea2fad9aa742407e45",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "zerkalo-slon-kraken.ru",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "zerkalo-slon-kraken.ru",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "zerkalo-slon-kraken.ru",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "zerkalo-slon-kraken.ru",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.96.0",
        "whois": {
            "registrar": "RU-CENTER-RU",
            "created": "2026-03-12T06:54:15Z",
            "expires": "2027-03-12T06:54:15Z",
            "nameservers": [
                "amos.ns.cloudflare.com",
                "kay.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:35:11Z",
        "analysis_at": "2026-10-07T02:05:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Dr.Web": "drugs",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-03-12T00:00:00Z",
        "first_seen": "2026-03-12T07:43:04Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.47.18"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "amos.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.143.198"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "amos.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kay.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:8fc6"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:2f12"
            }
        ],
        "dns_at": "2026-10-07T02:05:17Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.zerkalo-slon-kraken.ru",
                "zerkalo-slon-kraken.ru"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5c04213c891865f47c762c9be6e13eb2ef",
            "sha256": "181d20eaf2d56c7cf26a89148c28d6d0c0163c209205cd9ec2be3f5822484a57",
            "subject": "zerkalo-slon-kraken.ru",
            "valid_to": "2026-12-04T11:17:26Z",
            "valid_from": "2026-09-05T11:17:27Z"
        }
    }
}
```