# PhishDestroy domain threat record: 3king.vin

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/3king.vin/
Machine-readable companion: https://phishdestroy.io/domain/3king.vin/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 10:45:46 UTC
- Last availability or vendor check: 2026-10-28 12:31:35 UTC
- Stored record updated: 2026-10-28 12:31:35 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.18.240
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-08-05 12:48:24 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a18220-f580-7611-8f79-f7a533761b42/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/3king.vin
- Certificate Transparency search: https://crt.sh/?q=%25.3king.vin
- Web Archive lookup: https://web.archive.org/web/*/https://3king.vin/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classified 3king.vin as a gambling‑related threat because the page advertises slots, live casino games and sports betting while offering payment options that are frequently abused in scams. The intake system recorded a multi‑source alert on 2026-10-28 citing a fresh URLScan verdict of malicious and AI‑derived phishing confidence of 90 %. The domain was first seen by PhishDestroy on 2026-10-28 and returned an HTTP 200 response on that date.

How the scam works
Fraudulent gambling sites typically lure visitors with promises of easy winnings, display local payment methods to build trust, and then collect deposits that may never be paid out. They often harvest login credentials or personal data through phishing forms and can use the information for further financial fraud or identity theft. The model does not require the site to host actual gambling infrastructure; the primary risk is monetary loss and credential compromise.

Evidence
URLScan captured the site on 2026-10-25 and again on 2026-10-28, assigning a malicious verdict with a 100 % phishing score and labeling the brand as generic gambling. VirusTotal scanned the domain on 2026-10-28 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the URL. OTX listed four pulses referencing the domain as of 2026-10-28. PhishDestroy’s internal blocklist marks the domain as malicious, while external blocklists returned no matches and Spamhaus DBL listed it as clean.

Infrastructure
The recorded DNS returned Cloudflare IP addresses 172.67.183.233 and 104.21.18.240, and the captured TLS certificate was issued by Google Trust Services, valid through 2027-01-02. The domain was registered with Dynadot Inc on 2026-08-05, 84 days before its first sighting. The hosting network belongs to ASNs 15169 (Google) and 13335 (Cloudflare). No DNSSEC records were observed.

What to do
Users should avoid entering any personal, login or payment information on the site and, if such data was submitted, change associated passwords and monitor financial accounts for unauthorized activity. Security teams should block 3king.vin at the firewall or proxy, review logs for connections to the recorded IPs, and note that PhishDestroy already flags this domain as malicious for targeted mitigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a18220-f580-7611-8f79-f7a533761b42/
Cloudflare Radar report: https://radar.cloudflare.com/scan/fc9b27e6-1e95-4aa5-acb3-df2cf8d5d09e
URLQuery report: https://urlquery.net/report/e7a70b34-0ac5-460d-a2ec-080e975f1a3f
Stored capture screenshot: https://i.ibb.co/qY8bpMGg/699932acbc01.png
Cloudflare Radar screenshot (2026-10-28T10:47:51Z): https://screenshots.phishdestroy.io/cf/fc9b27e6-1e95-4aa5-acb3-df2cf8d5d09e.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/e7a70b34-0ac5-460d-a2ec-080e975f1a3f.png
URLScan screenshot (2026-08-09T06:02:23Z): https://screenshots.phishdestroy.io/us/019fe51d-600d-772f-ae22-4ae24593c44f.png
URLScan capture report: https://urlscan.io/result/019fe51d-600d-772f-ae22-4ae24593c44f/
URLScan screenshot (2026-10-25T16:08:45Z): https://screenshots.phishdestroy.io/us/01a173d2-3405-77bc-9f5a-3e0553520248.png
URLScan capture report: https://urlscan.io/result/01a173d2-3405-77bc-9f5a-3e0553520248/
URLScan screenshot (2026-10-28T10:46:36Z): https://screenshots.phishdestroy.io/us/01a1821e-3b10-7592-ad0e-467c96575bd3.png
URLScan capture report: https://urlscan.io/result/01a1821e-3b10-7592-ad0e-467c96575bd3/
VirusTotal report: https://www.virustotal.com/gui/domain/3king.vin
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=3king.vin
Archived copy: https://web.archive.org/web/20261028104601/https://3king.vin/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 11:48:54 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qY8bpMGg/699932acbc01.png
  Captured: 2026-10-28 10:50:13 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a18220-f580-7611-8f79-f7a533761b42.png
  Captured: 2026-10-28 10:50:13 UTC
  Source report: https://urlscan.io/result/01a18220-f580-7611-8f79-f7a533761b42/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a173d2-3405-77bc-9f5a-3e0553520248.png
  Captured: 2026-10-28 10:45:46 UTC
  Source report: https://urlscan.io/result/01a18220-f580-7611-8f79-f7a533761b42/
- URLScan · 2026-08-09: https://screenshots.phishdestroy.io/us/019fe51d-600d-772f-ae22-4ae24593c44f.png
  Captured: 2026-08-09 06:02:23 UTC
  Source report: https://urlscan.io/result/019fe51d-600d-772f-ae22-4ae24593c44f/
  SHA-256: 197bc24732ae0f176436c138ecb520a42f188c4c832df15600cb5c41c4400af8
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a1821e-3b10-7592-ad0e-467c96575bd3.png
  Captured: 2026-10-28 10:46:36 UTC
  Source report: https://urlscan.io/result/01a1821e-3b10-7592-ad0e-467c96575bd3/
  SHA-256: 4d0e7683b167cad205804c8c7fe0bdec9b34ad1137ce31b5541b0c0ec3a452e3
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fc9b27e6-1e95-4aa5-acb3-df2cf8d5d09e.png
  Captured: 2026-10-28 10:47:51 UTC
  Source report: https://radar.cloudflare.com/scan/fc9b27e6-1e95-4aa5-acb3-df2cf8d5d09e
  SHA-256: 3252f34b39dabc14905bd20753a171579d70a0e00f1d428553ec2ef2a156adf4
- URLQuery: https://screenshots.phishdestroy.io/uq/e7a70b34-0ac5-460d-a2ec-080e975f1a3f.png
  Source report: https://urlquery.net/report/e7a70b34-0ac5-460d-a2ec-080e975f1a3f
  SHA-256: ac556f5bce0d210d79d54e1e5868f6f49b638b0b2d78a9e9ccddfbcf3cbc56e6
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173d2-3405-77bc-9f5a-3e0553520248.png
  Captured: 2026-10-25 16:08:45 UTC
  Source report: https://urlscan.io/result/01a173d2-3405-77bc-9f5a-3e0553520248/
  SHA-256: d73c5c4c3d3af8a8d0a146bd46ec02e6dafbca9732ef63f984bebc5adee378dd

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T10:52:56Z",
        "uuid": "01a18220-f580-7611-8f79-f7a533761b42",
        "scanned_at": "2026-10-28T10:49:29Z",
        "final_url": "https://3king.vin/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://3king.vin/",
                "from": "http://3king.vin/",
                "status": 307
            }
        ],
        "ip": "172.67.183.233",
        "domains": [
            "cdn.jsdelivr.net",
            "fonts.gstatic.com",
            "static.cloudflareinsights.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "172.217.25.195",
            "104.16.79.73",
            "142.250.195.138",
            "104.16.180.112",
            "172.67.183.233"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "good8833.cc"
        ],
        "doc_hash": "8b9bb1cba397dad05cc14db43a6d59e8edded3dacb227ef872284c453fbf1a8e",
        "script_hashes": [
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8"
        ],
        "globals": [
            "__brStickSimple",
            "uidEvent",
            "bootstrap",
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "3king.vin",
                "*.3king.vin"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "3king.vin",
            "protocol": "QUIC",
            "valid_to": "2027-01-02T18:50:26Z",
            "valid_from": "2026-10-04T17:50:29Z"
        },
        "domain_age_days": 1450,
        "apex_age_days": 1450,
        "tls_age_days": 23,
        "tls_valid_days": 90,
        "requests": 29,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericgambling"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic Gambling"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T10:48:08Z",
        "uuid": "fc9b27e6-1e95-4aa5-acb3-df2cf8d5d09e",
        "scanned_at": "2026-10-28T10:47:51Z",
        "final_url": "https://3king.vin/",
        "status": 200,
        "history": [
            {
                "url": "https://3king.vin/",
                "status": 200
            }
        ],
        "dom_hash": "2a7e62e155c741f7a7401fcf36005401978bfd884b5b335dc2ac07742a5ce9ee",
        "doc_hash": "0646e1664276c1fdc7d904a92ec9f85e730304811610c2c239ba5487b67ae068",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "3king.vin",
                "type": "A",
                "value": "172.67.183.233"
            },
            {
                "name": "3king.vin",
                "type": "A",
                "value": "104.21.18.240"
            },
            {
                "name": "3king.vin",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:12f0"
            },
            {
                "name": "3king.vin",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:b7e9"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.23",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-08-05T14:48:24Z",
            "updated": "2026-08-12T04:16:50Z",
            "expires": "2027-08-05T14:48:24Z",
            "nameservers": [
                "demi.ns.cloudflare.com",
                "marvin.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T11:48:31Z",
        "analysis_at": "2026-10-28T09:26:19Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-08-06T15:15:29Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "marvin.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "demi.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "demi.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.18.240"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:12f0"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.183.233"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:b7e9"
            }
        ],
        "dns_at": "2026-10-28T09:30:01Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "3king.vin",
                "*.3king.vin"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "a00ca77088d0b9cd13705f2139c8380b",
            "sha256": "9dbecf4b780b3646c49021a7d80cfadd0278e4dada2c4acbd68b3d7962aa4bae",
            "subject": "3king.vin",
            "valid_to": "2027-01-02T18:50:26Z",
            "valid_from": "2026-10-04T17:50:29Z"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-08-05T14:48:24Z",
                "last changed": "2026-08-06T14:08:33Z",
                "registration": "2026-08-05T14:48:24Z",
                "registrar expiration": "2027-08-05T14:48:24Z",
                "last update of RDAP database": "2026-10-27T07:54:15Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T10:48:31Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "3king.vin"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-28T10:46:01Z",
            "first": "2021-11-23T09:18:27Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0,
            "avg_page_bytes": 11240
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://3king.vin/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 16
        },
        "social_tags": {
            "ogUrl": "https://3king.vin/",
            "title": "3 king Việt Nam – Slot và Thể thao, Thưởng Hằng Ngày",
            "ogType": "website",
            "ogImage": "https://3king.vin/assets/logo.png",
            "ogTitle": "3 king Việt Nam – Slot và Thể thao, Thưởng Hằng Ngày",
            "ogSiteName": "3 king",
            "themeColor": "#1a0a08",
            "description": "3 king mang sảnh casino trực tiếp, slot và cá cược thể thao đến tay bạn — nạp rút qua MoMo, ZaloPay, Viettel Money, truy cập mọi lúc trên điện thoại tại Việt Nam",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://3king.vin/",
            "ogDescription": "3 king mang sảnh casino trực tiếp, slot và cá cược thể thao đến tay bạn — nạp rút qua MoMo, ZaloPay, Viettel Money, truy cập mọi lúc trên điện thoại tại Việt Nam"
        },
        "trackers": {
            "requests": 17,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 5
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1,
                "tls": 18,
                "wait": 410,
                "connect": 6,
                "download": 84
            },
            "response_ms": 519
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 102531,
            "co2_grams": 0.0038,
            "cleaner_than": 21
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.95",
                    "host": "demi.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.44.251",
                    "host": "marvin.ns.cloudflare.com"
                }
            ],
            "zone": "3king.vin"
        },
        "location": {
            "ip": "2606:4700:3032::ac43:b7e9",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "3king.vin"
        },
        "dns": {
            "A": [
                "104.21.18.240",
                "172.67.183.233"
            ],
            "NS": [
                "demi.ns.cloudflare.com",
                "marvin.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"demi.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416625540, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3033::6815:12f0",
                "2606:4700:3032::ac43:b7e9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3032::ac43:b7e9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://3king.vin"
            ]
        },
        "linked_pages": {
            "internal_count": 26
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```