# PhishDestroy threat dossier — m.mrtking-guncel13.net ================================================================ Fetched: 2026-07-31 04:26:38 UTC Canonical: https://phishdestroy.io/domain/m.mrtking-guncel13.net/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 95/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, PhishFort, SOCRadar Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Dynadot Inc Nameservers: ["harlan.ns.cloudflare.com", "olga.ns.cloudflare.com"] Page title: mrtking-guncel13.net | 520: Web server is returning an unknown error HTTP response: 520 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-03 Status: INVALID chain Fingerprint: 38674c4350975d60c641f041d5d45c079547db8d6f4782d8d6bda5a8143dff40 Subject Alternative Names (related infrastructure — often same operator): - mrtking-guncel13.net ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 12:38:24 UTC (by PhishDestroy tracker) Last verified: 2026-07-31 04:20:34 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-20 00:07:49 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is m.mrtking-guncel13.net a Phishing Site? Analysis of the sub‑domain m.mrtking-guncel13.net shows it is currently active and associated with a generic phishing threat. The domain resolves to the Cloudflare IP address 188.114.96.3, which places the infrastructure in Canada and masks the true hosting location. DNS is delegated to harlan.ns.cloudflare.com and olga.ns.cloudflare.com, both Cloudflare‑controlled name servers, confirming the use of a CDN for anonymity. An HTTP 301 redirect is observed, and the page title returned by the server is "mrtking-guncel13.net | 520: Web server is returning an unknown error," indicating the site presently serves a Cloudflare 520 error page rather than a visible landing page. The TLS certificate is issued by Google Trust Services under the WE1 certificate authority, a standard certificate that does not provide additional risk cues. VirusTotal reports that six of ninety‑one security vendors have flagged the domain, suggesting that a minority of scanners have identified malicious characteristics. The domain appears on at least one external blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment of phishing activity. Registration was performed through Dynadot Inc, a registrar that does not inherently imply legitimacy or maliciousness. Because the actual content of the site has not been captured, the specific phishing lure, target brand, or credential‑harvesting mechanism remains unknown. Defenders should treat the domain as hostile: block the domain and its associated sub‑domains at network perimeter, add the IP address 188.114.96.3 to deny‑list rules, monitor DNS queries for related Cloudflare name servers, and ensure threat‑intel feeds are updated with the current blocklist entry. Further investigation, such as sandbox retrieval of the landing page if it becomes reachable, is recommended to clarify the payload and victim profile. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 38674c4350975d60c641f041d5d45c079547db8d6f4782d8d6bda5a8143dff40 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/m.mrtking-guncel13.net/ JSON API: https://api.destroy.tools/v1/check?domain=m.mrtking-guncel13.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,187 domains (84,173 alive under monitoring, 27,015 confirmed neutralized). Site: https://phishdestroy.io