# PhishDestroy domain threat record: mrking100085.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mrking100085.com/
Machine-readable companion: https://phishdestroy.io/domain/mrking100085.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 00:05:43 UTC
- Last availability or vendor check: 2026-10-22 10:49:36 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 65.38.121.165
- Registrar in stored WHOIS data: TUCOWS.COM, CO.
- Last stored HTTP status: 200
- Registration date (registry RDAP, mrking100085.com): 2026-10-19 00:47:14 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a160ec-c019-740c-9741-15a29e41d6df/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mrking100085.com
- Certificate Transparency search: https://crt.sh/?q=%25.mrking100085.com
- Web Archive lookup: https://web.archive.org/web/*/https://mrking100085.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added mrking100085.com to its internal blocklist on 2026-10-22 after an automated rule detected a phishing label on VirusTotal. The prior AI assessment described the page as a Turkish gambling‑warning notice and found no evidence of credential theft or brand impersonation. An HTTP request on 2026-10-22 returned a 200 OK response and recorded the title "Kumar Oynamayın".

How the scam works
A domain that receives a phishing label from VirusTotal may be used to mimic legitimate services and attempt to collect user credentials or personal data, but no such behavior was observed on this page. The listing therefore reflects a potential risk category rather than a confirmed malicious mechanism.

Evidence
VirusTotal analysis on 2026-10-20 reported 2 detections out of 92 engines: PhishFort marked the domain as phishing and alphaMountain.ai labeled it suspicious. Google Safe Browsing checked on 2026-10-22 did not flag the site. urlscan.io captured the page on 2026-10-22 and assigned a malicious ML score of 96, while its overall verdict was non‑malicious. OTX listed 0 pulses as of 2026-10-22. PhishDestroy’s internal blocklist shows the domain as listed, and external blocklists returned zero hits on the same date. The page fetch recorded a 200 HTTP status and the title "Kumar Oynamayın".

Infrastructure
The domain was registered with Tucows Domains Inc. on 2026-10-19 and carries clientTransferProhibited and clientUpdateProhibited status flags. The recorded A record points to 65.38.121.165, associated with Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal in the Netherlands. The TLS certificate, issued by Let’s Encrypt, is valid until 2027-01-17 and the response headers show Cloudflare and Nginx components.

What to do
Visitors should avoid entering any credentials or personal information on the site; if they have already done so, they should change passwords for the affected accounts. Security teams can block mrking100085.com at the network perimeter and monitor access logs for connections to this address. No wallet‑related remediation is required.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a160ec-c019-740c-9741-15a29e41d6df/
Cloudflare Radar report: https://radar.cloudflare.com/scan/35497fac-b193-4a04-bfce-3b0d607a38a8
Stored capture screenshot: https://i.ibb.co/ynVySbJ4/ff9d9c6ca006.png
Cloudflare Radar screenshot (2026-10-22T00:05:58Z): https://screenshots.phishdestroy.io/cf/35497fac-b193-4a04-bfce-3b0d607a38a8.png
VirusTotal report: https://www.virustotal.com/gui/domain/mrking100085.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrking100085.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 00:07:12 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/ynVySbJ4/ff9d9c6ca006.png
  Captured: 2026-10-22 00:05:43 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a160ec-c019-740c-9741-15a29e41d6df.png
  Captured: 2026-10-22 00:05:43 UTC
  Source report: https://urlscan.io/result/01a160ec-c019-740c-9741-15a29e41d6df/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/35497fac-b193-4a04-bfce-3b0d607a38a8.png
  Captured: 2026-10-22 00:05:58 UTC
  Source report: https://radar.cloudflare.com/scan/35497fac-b193-4a04-bfce-3b0d607a38a8
  SHA-256: dbc01e33d251f038cd3ead512d12cbc236387e55b6514a95a2b84ae85c838401

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T00:06:25Z",
        "uuid": "01a160ec-c019-740c-9741-15a29e41d6df",
        "scanned_at": "2026-10-22T00:05:00Z",
        "final_url": "https://www.mrking100085.com/",
        "status": 200,
        "ip": "65.38.121.165",
        "domains": [
            "cdn.dwqsa.mom"
        ],
        "ips": [
            "172.67.207.24",
            "65.38.121.165"
        ],
        "asns": [
            "13335",
            "399629"
        ],
        "countries": [
            "RO"
        ],
        "link_domains": [
            "www.yedam.org.tr",
            "gamblingtherapy.org",
            "www.gamcare.org.uk",
            "www.yesilay.org.tr",
            "www.gambleaware.org",
            "register-of-charities.charitycommission.gov.uk"
        ],
        "doc_hash": "83c1886f50e3e275ef5366c175c93c08d90769c27d3c102bcc6cb9c172ba5e09",
        "script_hashes": [
            "67a15c1c477d1adb6125cf49d60f973460a803f0ea4870586b6e7720b2a8bfb7",
            "a4590375a64190f57d18b357bf576bf111bd5f02f3c93cad0f65fdf176689f46",
            "a342dc1f42035a70a721f3081250a6645fab047c2e268f1453686349a6f16548",
            "23556d5df67eae2b4ad940e5c85fcc58fdc35d17849350052df4fae8336ae9bf",
            "646de7920c69d49625b1f9ba76435a1fd621ff6680d032769a22a729befe18d8",
            "217f4f7ef54900bf37028545e5924e713533b1a93736fb79af9d7a141d8893ca",
            "b662baf138854bad74affeea41ec58e3fcf596fbba970a584d63f14cf6ccbda6",
            "002222803784602bb22d006b764f438370772996145b1d852cacb864b2005094",
            "47fd4aba67d23847b217f31a641fade118400fb960d7f98f9ff7aa2d05ebc5c5",
            "09f48ae5f02511b07abb9299f627f1719c2e33cbe2c10c21ff2aa1dd9802a911"
        ],
        "globals": [
            "TURBOPACK",
            "$RT",
            "$RB",
            "$RV",
            "$RC",
            "__next_f",
            "next",
            "__webpack_hash__"
        ],
        "storage_keys": [
            "quiet-lang"
        ],
        "tls": {
            "san": [
                "mrking100085.com",
                "www.mrking100085.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "mrking100085.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T22:50:19Z",
            "valid_from": "2026-10-21T22:50:20Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 1,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains",
            "content-security-policy": "base-uri 'self'; connect-src 'self' https: wss:; default-src 'self'; font-src 'self' data: https:; form-action 'self'; frame-ancestors 'none'; frame-src https://mkemsports.datalivehost.com https://spo",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer",
            "permissions-policy": "camera=(), geolocation=(), microphone=()",
            "cross-origin-opener-policy": "same-origin",
            "cross-origin-resource-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T00:06:26Z",
        "uuid": "35497fac-b193-4a04-bfce-3b0d607a38a8",
        "scanned_at": "2026-10-22T00:05:58Z",
        "final_url": "https://mrking100085.com/",
        "status": 200,
        "history": [
            {
                "url": "https://mrking100085.com/",
                "status": 200
            }
        ],
        "dom_hash": "8c614966877ddfabf2b0216a1705b8f3018e71b33eded4a3fe2fc8eeb1dbf543",
        "doc_hash": "9c2ebcee078ae6443a39fcb2cf0e4c4a64f4bb53b0d6b722b22dd6f846482edc",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mrking100085.com",
                "type": "A",
                "value": "65.38.121.165"
            }
        ],
        "dnssec_valid": false,
        "ip": "65.38.121.165",
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2026-10-19T00:47:14Z",
            "updated": "2026-10-21T23:47:48Z",
            "expires": "2027-10-19T00:47:14Z",
            "nameservers": [
                "1-you.njalla.no",
                "2-can.njalla.in",
                "3-get.njalla.fo"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T00:05:53Z",
        "analysis_at": "2026-10-20T16:16:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 37
        },
        "detections": {
            "PhishFort": "phishing",
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "registrar": "Tucows Domains Inc.",
        "created": "2026-10-19T00:47:14Z",
        "expires": "2027-10-19T00:47:14Z",
        "updated": "2026-10-19T19:00:03Z",
        "first_seen": "2026-10-19T19:15:32Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "185.11.145.145"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "185.11.145.254"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "dns1.blazingfast.io"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.blazingfast.io",
                "value": "dns1.blazingfast.io"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "dns2.blazingfast.io"
            }
        ],
        "dns_at": "2026-10-20T16:51:46Z",
        "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "*.mrking100085.com",
                "mrking100085.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "58c9113566dbdc2a403859b1fd03db48fb1",
            "sha256": "54ac6a98fd3e88c06aa835469178412fdaee156483be634e8130917b57ef3ff4",
            "subject": "mrking100085.com",
            "valid_to": "2027-01-17T18:07:55Z",
            "valid_from": "2026-10-19T18:07:56Z"
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "registrar_iana_id": "69",
            "registrar_url": "http://www.tucows.com",
            "created": "2026-10-19T00:47:14Z",
            "updated": "2026-10-19T19:00:03Z",
            "expires": "2027-10-19T00:47:14Z",
            "status": [
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.blazingfast.io",
                "dns2.blazingfast.io"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "expiration": "2027-10-19T00:47:14Z",
                "last changed": "2026-10-19T19:00:03Z",
                "registration": "2026-10-19T00:47:14Z",
                "last update of RDAP database": "2026-10-19T19:15:04Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T00:06:41Z",
        "caa_records": {
            "domain": "mrking100085.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 643,
                "tls": 49,
                "wait": 199,
                "connect": 35,
                "download": 43
            },
            "response_ms": 969
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "92.223.100.53",
                    "host": "ns1.gcorelabs.net"
                },
                {
                    "ip": "92.223.77.53",
                    "host": "ns2.gcdn.services"
                }
            ],
            "zone": "mrking100085.com"
        },
        "location": {
            "ip": "185.11.145.254",
            "asn": "47674",
            "org": "Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal",
            "city": "Amsterdam",
            "country": "NL"
        },
        "dns": {
            "A": [
                "65.38.121.165"
            ],
            "NS": [
                "ns1.gcorelabs.net",
                "ns2.gcdn.services"
            ],
            "SOA": "{\"nsname\": \"ns1.gcorelabs.net\", \"hostmaster\": \"support.gcore.com\", \"serial\": 1792619099, \"refresh\": 5400, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "65.38.121.165",
            "family": 4
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.mrking100085.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "React",
                "Next.js",
                "Render",
                "Nginx",
                "Priority Hints",
                "HSTS",
                "Cloudflare",
                "Webpack",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2026-10-19T00:47:14Z",
            "updated": "2026-10-21T23:47:48Z",
            "expires": "2027-10-19T00:47:14Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "1-you.njalla.no",
                "2-can.njalla.in",
                "3-get.njalla.fo"
            ]
        },
        "headers": {
            "headers": {
                "server": "BlazingFastWeb",
                "content-type": "text/html"
            }
        }
    }
}
```