# PhishDestroy domain threat record: kingjoker2052.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/kingjoker2052.com/
Machine-readable companion: https://phishdestroy.io/domain/kingjoker2052.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 23:26:58 UTC
- Last availability or vendor check: 2026-10-23 01:00:19 UTC
- Stored record updated: 2026-10-23 06:22:04 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.1
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 403
- Registration date (registry RDAP, kingjoker2052.com): 2026-10-22 17:15:29 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1652b-102a-718a-a699-a5415d6ae8be/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/kingjoker2052.com
- Certificate Transparency search: https://crt.sh/?q=%25.kingjoker2052.com
- Web Archive lookup: https://web.archive.org/web/*/https://kingjoker2052.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed kingjoker2052.com on 2026-10-23 after its intake system flagged the site as a newly‑registered domain with only a Cloudflare challenge page, preventing content analysis. The domain was first seen by PhishDestroy on 2026-10-23, one day after its registration on 2026-10-22, and returned HTTP 403 at the time of the fetch.

How the scam works
The current evidence does not show a concrete phishing, malware or fraud mechanism; the domain is simply categorized as suspicious because new sites that serve only a challenge page are often used for malicious campaigns. Without visible content, no specific scam flow can be confirmed for this domain.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported zero malicious or suspicious detections from 92 engines. Google Safe Browsing checked the domain on 2026-10-23 and did not flag it. urlscan captured the site on 2026-10-22, recorded a 403 response and an engine‑based malicious score of 82, but its overall verdict was non‑malicious; no external blocklists listed the domain and OTX had zero pulses as of 2026-10-23. PhishDestroy’s internal blocklist marks the domain as listed.

Infrastructure
The domain was registered with Spaceship, Inc. on 2026-10-22 and uses Cloudflare nameservers (anderson.ns.cloudflare.com, annalise.ns.cloudflare.com). Hosting is provided through Cloudflare’s network, with recorded IPs including 188.114.96.1 (Canada) and 104.21.86.56; the TLS certificate is issued by Let’s Encrypt, valid until 2027-01-20, and covers *.kingjoker2052.com. No further infrastructure details indicate operator identity.

What to do
Visitors should avoid entering any credentials or personal data on the site; if credentials were submitted, change the associated passwords immediately. No wallet‑related recommendations apply because wallet interactions were not observed. Defenders should block kingjoker2052.com at the firewall or proxy, monitor access logs for any requests to this exact domain, and treat it as a potentially malicious indicator.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1652b-102a-718a-a699-a5415d6ae8be/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8108981a-901c-4e1f-9c0c-92346e4e2cf7
Stored capture screenshot: https://urlscan.io/screenshots/01a1652b-102a-718a-a699-a5415d6ae8be.png
VirusTotal report: https://www.virustotal.com/gui/domain/kingjoker2052.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kingjoker2052.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 23:29:22 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1652b-102a-718a-a699-a5415d6ae8be.png
  Captured: 2026-10-22 23:26:58 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1652b-102a-718a-a699-a5415d6ae8be.png
  Source report: https://urlscan.io/result/01a1652b-102a-718a-a699-a5415d6ae8be/
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a165f2-7943-751a-9af1-1fcb82cf90b6.png
  Captured: 2026-10-22 23:29:17 UTC
  Source report: https://urlscan.io/result/01a165f2-7943-751a-9af1-1fcb82cf90b6/
  SHA-256: 1c4cea17e2f6b5748d45c6128e707106ed718e6019ade26d6cb30587ec318c95
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a166b6-63d2-76ee-b234-079107c47439.png
  Captured: 2026-10-23 03:03:17 UTC
  Source report: https://urlscan.io/result/01a166b6-63d2-76ee-b234-079107c47439/
  SHA-256: fe0960901302f23444c54eac1628bbb21c21e524aa1d03d83bd291c24bbe5a68

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T23:28:38Z",
        "uuid": "01a1652b-102a-718a-a699-a5415d6ae8be",
        "scanned_at": "2026-10-22T19:51:33Z",
        "final_url": "https://kingjoker2052.com/",
        "status": 403,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://kingjoker2052.com/",
                "from": "http://kingjoker2052.com/",
                "status": 307
            }
        ],
        "ip": "104.21.86.56",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.80.73",
            "104.21.86.56"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "61a37cd8b99f136a28d4acc53fff280f065d3d2f34f64afe9cfbef7e2ad1a46c",
        "globals": [
            "_cf_translation",
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.kingjoker2052.com",
                "kingjoker2052.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "kingjoker2052.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-20T16:25:02Z",
            "valid_from": "2026-10-22T16:25:03Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 82,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T23:28:39Z",
        "uuid": "8108981a-901c-4e1f-9c0c-92346e4e2cf7",
        "scanned_at": "2026-10-22T23:28:20Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T23:28:13Z",
        "analysis_at": "2026-10-22T19:34:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "Spaceship, Inc.",
        "created": "2026-10-22T17:15:29Z",
        "expires": "2027-10-22T17:15:29Z",
        "updated": "2026-10-22T17:21:46Z",
        "first_seen": "2026-10-22T17:28:11Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "anderson.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.215.89"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.86.56"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "anderson.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "annalise.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T19:38:49Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "*.kingjoker2052.com",
                "kingjoker2052.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "54718c19e2bf5b41254c40a21197281bb89",
            "sha256": "5f21eff80e8901b4112db69f162d71d8212b597c09d80e8b037339530595dfb7",
            "subject": "kingjoker2052.com",
            "valid_to": "2027-01-20T16:25:02Z",
            "valid_from": "2026-10-22T16:25:03Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "registrar_url": "http://www.spaceship.com",
            "created": "2026-10-22T17:15:29Z",
            "updated": "2026-10-22T17:21:46Z",
            "expires": "2027-10-22T17:15:29Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "anderson.ns.cloudflare.com",
                "annalise.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-10-22T17:21:46Z",
                "registration": "2026-10-22T17:15:29Z",
                "registrar expiration": "2027-10-22T17:15:29Z",
                "last update of RDAP database": "2026-10-22T17:28:01Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T23:28:53Z",
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.177",
                    "host": "anderson.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.234",
                    "host": "annalise.ns.cloudflare.com"
                }
            ],
            "zone": "kingjoker2052.com"
        },
        "location": {
            "ip": "188.114.96.9",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "kingjoker2052.com"
        },
        "dns": {
            "A": [
                "188.114.96.9",
                "188.114.97.9"
            ],
            "NS": [
                "anderson.ns.cloudflare.com",
                "annalise.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"anderson.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418175521, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "188.114.96.9",
            "family": 4
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-22T17:15:29Z",
            "updated": "2026-10-22T17:21:46Z",
            "expires": "2027-10-22T17:15:29Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "anderson.ns.cloudflare.com",
                "annalise.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-frame-options": "SAMEORIGIN",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```