# PhishDestroy domain threat record: emrebilisim45.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/emrebilisim45.com/
Machine-readable companion: https://phishdestroy.io/domain/emrebilisim45.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 11:13:47 UTC
- Last availability or vendor check: 2026-10-26 11:17:45 UTC
- Stored record updated: 2026-10-26 20:19:16 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 94.183.168.109
- Registrar in stored WHOIS data: Spaceship, Inc.

## Evidence links

- URLScan report: https://urlscan.io/result/01a177ed-8000-7579-987c-c6b7fe867db2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/emrebilisim45.com
- Certificate Transparency search: https://crt.sh/?q=%25.emrebilisim45.com
- Web Archive lookup: https://web.archive.org/web/*/https://emrebilisim45.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a browser error page reading This site can't be reached with the message The connection was reset and the code ERR_CONNECTION_RESET, offering Details and Reload buttons and showing no form or brand in that frame. PhishDestroy listed emrebilisim45.com because its intake assessment on 2026-10-26 recorded page content titled MrKing with Giriş Yap and Kayıt Ol controls, and the domain was first seen by PhishDestroy on 2026-10-26.

How the scam works
The recorded page presented login and registration controls beneath the MrKing name, a pattern PhishDestroy assesses as credential theft, where visitors type account details into an imitation of a service they trust. As a category risk, such a page also serves as an entry funnel for further requests for personal or account information.

Evidence
The screenshot shows only the connection-reset error, while the 2026-10-26 intake capture recorded the MrKing login and registration text. urlscan engine verdicts scored the captured page malicious at 84 on 2026-10-26, whereas an earlier intake scan returned clean, and VirusTotal did not flag the domain. Spamhaus listed it as spam on 2026-10-26, PhishDestroy's internal blocklist held the domain, external blocklists showed 0 entries, OTX held 0 pulses, and Google Safe Browsing did not flag it on 2026-10-26. The page fetch returned a redirect within the same domain with no cross-site redirect.

Infrastructure
Registrar Spaceship, Inc., registered 2026-10-25; hosting recorded on 2026-10-26, with no WAF or CDN identified in the captures. Notable weakness: no email authentication detected, with no SPF lookups recorded; TLS 1.3, TLS-AES-256-GCM-SHA384, forward secrecy, ALPN http/1.1, certificate recorded as not authorized; CAA records present; DNSSEC signed.

What to do
If you submitted credentials through emrebilisim45.com, change that password on the genuine MrKing service and enable two-factor authentication. Block emrebilisim45.com at your DNS or proxy layer, alert anyone who visited it, and review logs for related young lookalike domains.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a177ed-8000-7579-987c-c6b7fe867db2/
Cloudflare Radar report: https://radar.cloudflare.com/scan/10afd815-ffac-46e1-bf7c-c242f8f098cb
Stored capture screenshot: https://i.ibb.co/1YKdSFq2/87b256bad378.png
Cloudflare Radar screenshot (2026-10-26T11:14:05Z): https://screenshots.phishdestroy.io/cf/10afd815-ffac-46e1-bf7c-c242f8f098cb.png
URLScan screenshot (2026-10-26T11:14:07Z): https://screenshots.phishdestroy.io/us/01a177ea-c358-77a5-b0c6-9611e3db2b15.png
URLScan capture report: https://urlscan.io/result/01a177ea-c358-77a5-b0c6-9611e3db2b15/
VirusTotal report: https://www.virustotal.com/gui/domain/emrebilisim45.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=emrebilisim45.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:19:16 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/1YKdSFq2/87b256bad378.png
  Captured: 2026-10-26 11:17:45 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a177ed-8000-7579-987c-c6b7fe867db2.png
  Captured: 2026-10-26 11:17:45 UTC
  Source report: https://urlscan.io/result/01a177ed-8000-7579-987c-c6b7fe867db2/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a177e8-8891-750f-a2e6-5cadcbd5356f.png
  Captured: 2026-10-26 11:13:47 UTC
  Source report: https://urlscan.io/result/01a177ed-8000-7579-987c-c6b7fe867db2/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a177ea-c358-77a5-b0c6-9611e3db2b15.png
  Captured: 2026-10-26 11:14:07 UTC
  Source report: https://urlscan.io/result/01a177ea-c358-77a5-b0c6-9611e3db2b15/
  SHA-256: 87e01ec645b8a169ecf66d8baad9b87e64b9caeb32221141c0165e40a2cfe377
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/10afd815-ffac-46e1-bf7c-c242f8f098cb.png
  Captured: 2026-10-26 11:14:05 UTC
  Source report: https://radar.cloudflare.com/scan/10afd815-ffac-46e1-bf7c-c242f8f098cb
  SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T11:59:06Z",
        "uuid": "01a177ed-8000-7579-987c-c6b7fe867db2",
        "scanned_at": "2026-10-26T11:17:01Z",
        "final_url": "https://www.emrebilisim45.com/klavye/",
        "status": 200,
        "ip": "94.183.168.109",
        "ips": [
            "94.183.168.109"
        ],
        "asns": [
            "213995"
        ],
        "countries": [
            "GB"
        ],
        "doc_hash": "3731be6d28c50be36a5c2e7ece8d8039d437649b195dd2b93b87af524a548c8c",
        "tls": {
            "san": [
                "www.emrebilisim45.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "www.emrebilisim45.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-23T18:04:52Z",
            "valid_from": "2026-10-25T18:04:53Z"
        },
        "domain_age_days": 433,
        "apex_age_days": 433,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 84,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Tengine/3.1.0",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T11:14:47Z",
        "uuid": "10afd815-ffac-46e1-bf7c-c242f8f098cb",
        "scanned_at": "2026-10-26T11:14:05Z",
        "final_url": "https://emrebilisim45.com/",
        "history": [
            {
                "url": "https://emrebilisim45.com/",
                "status": 0
            }
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "emrebilisim45.com",
                "type": "A",
                "value": "94.183.168.109"
            }
        ],
        "dnssec_valid": true,
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-25T18:23:38Z",
            "updated": "2026-10-25T18:23:38Z",
            "expires": "2027-10-25T18:23:38Z",
            "nameservers": [
                "launch1.spaceship.net",
                "launch2.spaceship.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T11:14:00Z",
        "analysis_at": "2026-10-26T06:25:25Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Spaceship, Inc.",
        "created": "2026-10-25T18:23:38Z",
        "expires": "2027-10-25T18:23:38Z",
        "updated": "2026-10-25T18:23:38Z",
        "first_seen": "2025-08-18T11:32:08Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "support.spaceship.com",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "94.183.168.109"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch2.spaceship.net"
            }
        ],
        "dns_at": "2026-10-26T06:27:04Z",
        "jarm": "21d19d00021d21d00042d43d0000005ad20eceaf7f71ae0887d2ff117bf97f",
        "cert": {
            "san": [
                "royal-king-affaires.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "68102d4951e1c0e12c88f1aa9d6eb32346",
            "sha256": "955357583fbaee4e70b800d4f253106470f9b326b1e30bcbabdb28b4d2efb4b8",
            "subject": "royal-king-affaires.com",
            "valid_to": "2027-01-09T19:39:19Z",
            "valid_from": "2026-10-11T19:39:20Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "registrar_url": "http://www.spaceship.com",
            "created": "2026-10-25T18:23:38Z",
            "updated": "2026-10-25T18:23:38Z",
            "expires": "2027-10-25T18:23:38Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "launch1.spaceship.net",
                "launch2.spaceship.net"
            ],
            "dnssec": "signedDelegation"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-10-25T18:23:39Z",
                "registration": "2026-10-25T18:23:38Z",
                "registrar expiration": "2027-10-25T18:23:38Z",
                "last update of RDAP database": "2026-10-25T20:12:55Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T11:15:09Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "emrebilisim45.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2025-11-08T17:07:42Z",
            "first": "2025-11-08T17:07:42Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 51438
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": false,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.32",
                    "host": "launch2.spaceship.net"
                },
                {
                    "ip": "162.159.26.38",
                    "host": "launch1.spaceship.net"
                }
            ],
            "zone": "emrebilisim45.com"
        },
        "location": {
            "ip": "94.183.168.109",
            "asn": "213995",
            "org": "Belenkii Ivan Alexandrovich",
            "city": "Moscow",
            "country": "RU"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "royal-king-affaires.com"
        },
        "dns": {
            "A": [
                "94.183.168.109"
            ],
            "NS": [
                "launch1.spaceship.net",
                "launch2.spaceship.net"
            ],
            "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1792952955, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}"
        },
        "dnssec": {
            "ds": true,
            "rrsig": true,
            "dnskey": true
        },
        "get_ip": {
            "ip": "94.183.168.109",
            "family": 4
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-25T18:23:38Z",
            "updated": "2026-10-25T18:23:38Z",
            "expires": "2027-10-25T18:23:38Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "launch1.spaceship.net",
                "launch2.spaceship.net"
            ]
        }
    }
}
```