# PhishDestroy domain threat record: mrking-tr.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mrking-tr.net/
Machine-readable companion: https://phishdestroy.io/domain/mrking-tr.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-28 11:55:17 UTC
- Stored record updated: 2026-10-28 12:16:16 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: NameCheap, Inc.
- Registration date in stored WHOIS data: 2026-10-12 06:44:45 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1825a-cb4d-7739-a9fc-adb985daaf8c/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mrking-tr.net
- Certificate Transparency search: https://crt.sh/?q=%25.mrking-tr.net
- Web Archive lookup: https://web.archive.org/web/*/https://mrking-tr.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added mrking-tr.net to its internal blocklist because it is a newly registered domain (16 days old) and a Cloudflare challenge prevented page content analysis. The domain was first observed by PhishDestroy on 2026-10-28, when an HTTPS request returned HTTP 403.

How the scam works
The listing does not prove a particular scam; it flags the site as potentially risky because newly created domains are frequently used for phishing, credential harvesting, or malware distribution. Such sites may present deceptive pages or malicious downloads to trick visitors into revealing information.

Evidence
VirusTotal scanned the domain on 2026-10-26 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked it on 2026-10-28 and did not flag it. URLScan captured the site on 2026-10-28; the overall verdict was clean, but its machine‑learning engine labeled it malicious with a score of 86 and recorded a 307 redirect to HTTPS followed by an HTTP 403 response. No external blocklists reported the domain and OTX had no pulses as of 2026-10-28, while PhishDestroy’s internal list marks it as suspicious.

Infrastructure
The domain was registered with NameCheap on 2026-10-12. It is served through Cloudflare, resolving to IPv4 addresses 188.114.96.3 and 188.114.97.3 in the CloudFLARENET‑EU network located in London, GB. TLS is provided by a Let’s Encrypt certificate (valid 2026-10-26 to 2027-01-24) covering mrking-tr.net and *.mrking-tr.net. Authoritative nameservers are beau.ns.cloudflare.com and marge.ns.cloudflare.com, and DNSSEC is not enabled.

What to do
Do not enter any credentials, personal data, or cryptocurrency information on this site; if you have already done so, change the associated passwords immediately. Defenders should block mrking-tr.net, monitor DNS queries for it, and review web server logs for any requests to the domain, applying standard incident‑response procedures if suspicious activity is found.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1825a-cb4d-7739-a9fc-adb985daaf8c/
Cloudflare Radar report: https://radar.cloudflare.com/scan/ee089749-39e2-480b-9557-9de95210a7e9
Stored capture screenshot: https://urlscan.io/screenshots/01a1825a-cb4d-7739-a9fc-adb985daaf8c.png
Cloudflare Radar screenshot (2026-10-28T11:57:13Z): https://screenshots.phishdestroy.io/cf/ee089749-39e2-480b-9557-9de95210a7e9.png
URLScan screenshot (2026-10-27T16:42:31Z): https://screenshots.phishdestroy.io/us/01a17e3d-d745-70eb-8128-110371b0ef2a.png
URLScan capture report: https://urlscan.io/result/01a17e3d-d745-70eb-8128-110371b0ef2a/
URLScan screenshot (2026-10-28T11:55:15Z): https://screenshots.phishdestroy.io/us/01a1825d-5b86-752e-ae2c-32888caeae2a.png
URLScan capture report: https://urlscan.io/result/01a1825d-5b86-752e-ae2c-32888caeae2a/
VirusTotal report: https://www.virustotal.com/gui/domain/mrking-tr.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrking-tr.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 11:58:20 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1825a-cb4d-7739-a9fc-adb985daaf8c.png
  Captured: 2026-10-28 11:55:17 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1825a-cb4d-7739-a9fc-adb985daaf8c.png
  Source report: https://urlscan.io/result/01a1825a-cb4d-7739-a9fc-adb985daaf8c/
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17e3d-d745-70eb-8128-110371b0ef2a.png
  Captured: 2026-10-27 16:42:31 UTC
  Source report: https://urlscan.io/result/01a17e3d-d745-70eb-8128-110371b0ef2a/
  SHA-256: d5c166ae0cee771805edfdb3e6755dd3fe2a780f52fa1488d3db506df93fb6ef
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a1825d-5b86-752e-ae2c-32888caeae2a.png
  Captured: 2026-10-28 11:55:15 UTC
  Source report: https://urlscan.io/result/01a1825d-5b86-752e-ae2c-32888caeae2a/
  SHA-256: 6f4e5c3a48f217003605e45279dad9e59d37f76c83441d9a93d3fcc1598268e6
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ee089749-39e2-480b-9557-9de95210a7e9.png
  Captured: 2026-10-28 11:57:13 UTC
  Source report: https://radar.cloudflare.com/scan/ee089749-39e2-480b-9557-9de95210a7e9
  SHA-256: 447c9975fc7e3296bb350ca0306aecd30c19ffe0e5ea1f3923268bca14e45f0a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T11:57:29Z",
        "uuid": "01a1825a-cb4d-7739-a9fc-adb985daaf8c",
        "scanned_at": "2026-10-28T11:52:36Z",
        "final_url": "https://mrking-tr.net/",
        "status": 403,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://mrking-tr.net/",
                "from": "http://mrking-tr.net/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.79.73",
            "188.114.96.3"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "3298eda0b8bba82f16fcc6533c76362363415818dffbc400ea19022822e91415",
        "globals": [
            "_cf_translation",
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.mrking-tr.net",
                "mrking-tr.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "mrking-tr.net",
            "protocol": "QUIC",
            "valid_to": "2027-01-24T10:03:17Z",
            "valid_from": "2026-10-26T10:03:18Z"
        },
        "domain_age_days": 14,
        "apex_age_days": 14,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 10,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 86,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T11:57:31Z",
        "uuid": "ee089749-39e2-480b-9557-9de95210a7e9",
        "scanned_at": "2026-10-28T11:57:13Z",
        "final_url": "https://mrking-tr.net/",
        "status": 200,
        "history": [
            {
                "url": "https://mrking-tr.net/",
                "status": 200
            }
        ],
        "dom_hash": "ddae0a932a30fbf9ee4acda748e460ac7ba207f75714d150bfe07693ed8d2cc5",
        "doc_hash": "ad217e5e454002e02118901666954e032bb8f581a6b5c1ab42ebccf0074286d6",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mrking-tr.net",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "mrking-tr.net",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "mrking-tr.net",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "mrking-tr.net",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.22",
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-10-12T08:44:45Z",
            "updated": "2026-10-26T10:58:26Z",
            "expires": "2027-10-12T08:44:45Z",
            "nameservers": [
                "beau.ns.cloudflare.com",
                "marge.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T11:57:09Z",
        "analysis_at": "2026-10-26T18:15:55Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "NAMECHEAP INC",
        "created": "2026-10-12T08:44:45Z",
        "expires": "2027-10-12T08:44:45Z",
        "updated": "2026-10-26T10:58:26Z",
        "first_seen": "2026-10-15T13:39:59Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "beau.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:5c3a"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.92.58"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.187.19"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "beau.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "marge.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:bb13"
            }
        ],
        "dns_at": "2026-10-26T18:23:45Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.mrking-tr.net",
                "mrking-tr.net"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6b46ddcbdf0a955b4226ef56b94a5ebc50c",
            "sha256": "8774a105dcc935914e7be59c9e55cc658a93b4091e5dbd3eec728d64a8f1f3e6",
            "subject": "mrking-tr.net",
            "valid_to": "2027-01-24T10:03:17Z",
            "valid_from": "2026-10-26T10:03:18Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2026-10-12T08:44:45Z",
            "updated": "1-01-01T00:00:00Z",
            "expires": "2027-10-12T08:44:45Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "beau.ns.cloudflare.com",
                "marge.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "registration": "2026-10-12T08:44:45Z",
                "registrar expiration": "2027-10-12T08:44:45Z",
                "last update of RDAP database": "2026-10-26T18:23:45Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T11:57:53Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mrking-tr.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-28T11:55:32Z",
            "first": "2026-10-14T23:43:18Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.07,
            "avg_page_bytes": 9348
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.191",
                    "host": "marge.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.73",
                    "host": "beau.ns.cloudflare.com"
                }
            ],
            "zone": "mrking-tr.net"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "mrking-tr.net"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "beau.ns.cloudflare.com",
                "marge.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"beau.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418511218, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.mrking-tr.net"
            ]
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-10-12T08:44:45Z",
            "updated": "2026-10-26T10:58:26Z",
            "expires": "2027-10-12T08:44:45Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "beau.ns.cloudflare.com",
                "marge.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-frame-options": "SAMEORIGIN",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```