# PhishDestroy domain threat record: mrking100590.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mrking100590.com/
Machine-readable companion: https://phishdestroy.io/domain/mrking100590.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 09:02:00 UTC
- Last availability or vendor check: 2026-10-26 12:19:24 UTC
- Stored record updated: 2026-10-26 20:19:47 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Key-Systems GmbH
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-22 18:12:23 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17772-75a6-70ec-8ecf-0917fd1dfefd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mrking100590.com
- Certificate Transparency search: https://crt.sh/?q=%25.mrking100590.com
- Web Archive lookup: https://web.archive.org/web/*/https://mrking100590.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a Turkish-language Cloudflare human-verification screen bearing a MR KING crest and the heading Güvenlik doğrulaması yapılıyor, with a checkbox labeled Gerçek kişi olduğunuzu doğrulayın. The page metadata advertised MRKING100590 as Turkey's biggest online casino and premium slot platform. PhishDestroy listed the domain after a redirect-chain intake on 2026-10-26; it was first seen on 2026-10-26.

How the scam works
The observed metadata lured Turkish-speaking visitors with premium casino and slot offers, a category pattern in which users are pushed toward registration and deposits without consumer safeguards. The verification screen gated entry and harvested browser interaction before the funnel took over, and at intake the domain performed a client-side cross-site redirect into a confirmed phishing operation.

Evidence
The screenshot shows only the verification gate, with no payment or credential form visible. On 2026-10-26 urlscan ML scored the captured page malicious at 97, though its overall verdict read clean. VirusTotal flagged the domain as suspicious. Spamhaus listed it in the phishing category, PhishDestroy's internal blocklist flagged it while external blocklists counted 0, and OTX recorded 4 pulses. Google Safe Browsing did not flag it on 2026-10-26, and 0 of 12 DNS resolvers blocked it. The page ran jQuery and Swiper with Smartsupp Chat and jsDelivr trackers; document hash 317a36a00baa.

Infrastructure
Registered 2026-10-22 through Key-Systems GmbH and served behind the Cloudflare WAF. Notable weaknesses: TLS 1.3 with AES-256-GCM, forward secrecy and ALPN h2; CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; no SPF, DKIM or DMARC; CAA present; DNSSEC unsigned.

What to do
If you passed the verification or handed over credentials or payment details, change the password on any genuine service you reused, enable 2FA, and review account activity for unauthorized access or charges. Security teams should block mrking100590.com at DNS and proxy layers and hunt redirects or shared infrastructure linked to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17772-75a6-70ec-8ecf-0917fd1dfefd/
Cloudflare Radar report: https://radar.cloudflare.com/scan/f4336f2a-492d-4b52-87e9-cccc857c6fd5
Stored capture screenshot: https://i.ibb.co/GvB3C6L0/370207dfbcc5.png
Cloudflare Radar screenshot (2026-10-26T09:02:44Z): https://screenshots.phishdestroy.io/cf/f4336f2a-492d-4b52-87e9-cccc857c6fd5.png
URLScan screenshot (2026-10-26T09:02:40Z): https://screenshots.phishdestroy.io/us/01a17772-75a6-70ec-8ecf-0917fd1dfefd.png
VirusTotal report: https://www.virustotal.com/gui/domain/mrking100590.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrking100590.com
Archived copy: https://web.archive.org/web/20261026090329/https://mrking100590.com/tr/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:19:47 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/GvB3C6L0/370207dfbcc5.png
  Captured: 2026-10-26 09:03:43 UTC
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17772-75a6-70ec-8ecf-0917fd1dfefd.png
  Captured: 2026-10-26 09:02:40 UTC
  Source report: https://urlscan.io/result/01a17772-75a6-70ec-8ecf-0917fd1dfefd/
  SHA-256: 016fc05cf5322ef074c6bfda913b91e528f3d074cf7583a9d7e20265d904b4dc
- URLScan capture 2: https://urlscan.io/screenshots/01a17771-745d-74ee-85ff-8533643bcd79.png
  Captured: 2026-10-26 09:02:00 UTC
  Source report: https://urlscan.io/result/01a17772-75a6-70ec-8ecf-0917fd1dfefd/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f4336f2a-492d-4b52-87e9-cccc857c6fd5.png
  Captured: 2026-10-26 09:02:44 UTC
  Source report: https://radar.cloudflare.com/scan/f4336f2a-492d-4b52-87e9-cccc857c6fd5
  SHA-256: 9fc48609b9c83bed79a9cab0fb5271a400051a50151fdb898acbce3a06f5e43a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T09:33:05Z",
        "uuid": "01a17772-75a6-70ec-8ecf-0917fd1dfefd",
        "scanned_at": "2026-10-26T09:02:40Z",
        "final_url": "https://www.mrking100590.com/tr/",
        "status": 200,
        "ip": "188.114.97.12",
        "domains": [
            "widget-v3.smartsuppcdn.com",
            "cdn.jsdelivr.net",
            "websocket-visitors.smartsupp.com",
            "bootstrap.smartsuppchat.com",
            "www.smartsuppchat.com",
            "code.jquery.com"
        ],
        "ips": [
            "37.19.194.80",
            "3.125.68.253",
            "79.127.216.204",
            "151.101.193.155",
            "104.17.207.5",
            "188.114.97.12"
        ],
        "asns": [
            "60068",
            "16509",
            "54113",
            "13335"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "317a36a00baaf4163c4080f6bb6f0e7569d2e1b763e280ce079593979198e65b",
        "globals": [
            "$",
            "jQuery",
            "Swiper",
            "_smartsupp",
            "smartsupp",
            "SMARTSUPP_LOADED",
            "$smartsupp"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.mrking100590.com",
                "mrking100590.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "mrking100590.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-23T16:42:58Z",
            "valid_from": "2026-10-25T16:42:59Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 2,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 68,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T09:03:09Z",
        "uuid": "f4336f2a-492d-4b52-87e9-cccc857c6fd5",
        "scanned_at": "2026-10-26T09:02:44Z",
        "final_url": "https://mrking100590.com/tr/",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://mrking100590.com/",
                "status": 301
            },
            {
                "url": "https://mrking100590.com/tr/",
                "status": 200
            }
        ],
        "dom_hash": "0b8cccc5e4720d5ae332f19867f6f45764737d5850ea0f4d369e8c1761cbcc59",
        "doc_hash": "4be944db22ec28dff064e25e2529fa349b724ba29a87bedb17f7048801143ac6",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "New Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mrking100590.com",
                "type": "A",
                "value": "172.67.178.194"
            },
            {
                "name": "mrking100590.com",
                "type": "A",
                "value": "104.21.72.89"
            },
            {
                "name": "mrking100590.com",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:b2c2"
            },
            {
                "name": "mrking100590.com",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:4859"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.178.194",
        "whois": {
            "registrar": "Key-Systems GmbH",
            "created": "2026-10-22T20:12:23Z",
            "updated": "2026-10-22T20:12:26Z",
            "expires": "2027-10-22T20:12:23Z",
            "nameservers": [
                "chloe.ns.cloudflare.com",
                "rex.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T11:36:26Z",
        "analysis_at": "2026-10-25T23:05:53Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Suspicious, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "Key-Systems GmbH",
        "created": "2026-10-22T20:12:23Z",
        "expires": "2027-10-22T20:12:23Z",
        "updated": "2026-10-22T20:12:26Z",
        "first_seen": "2026-10-22T20:27:32Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "javier.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "javier.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:b2c2"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.178.194"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nataly.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:4859"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.72.89"
            }
        ],
        "dns_at": "2026-10-25T23:16:18Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.mrking100590.com",
                "mrking100590.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "67186936fa438fc567f5075422c85438ac",
            "sha256": "669c69f168876a3045bdc5d5affd39e0e2fdd7d41ffbe590017d5559d7b4013b",
            "subject": "mrking100590.com",
            "valid_to": "2027-01-23T16:42:58Z",
            "valid_from": "2026-10-25T16:42:59Z"
        },
        "whois": {
            "registrar": "Key-Systems GmbH",
            "registrar_iana_id": "269",
            "registrar_url": "-",
            "created": "2026-10-22T20:12:23Z",
            "updated": "2026-10-22T20:12:26Z",
            "expires": "2027-10-22T20:12:23Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "chloe.ns.cloudflare.com",
                "rex.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-22T20:12:23Z",
                "last changed": "2026-10-22T20:12:26Z",
                "registration": "2026-10-22T20:12:23Z",
                "registrar expiration": "2027-10-22T20:12:23Z",
                "last update of RDAP database": "2026-10-22T20:27:21Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T09:03:31Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mrking100590.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://mrking100590.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 48
        },
        "social_tags": {
            "ogUrl": "https://mrking100590.com/tr/",
            "title": "MRKING100590 Dünyanın ve Türkiye’nin En Büyük Online Casino Platformu ! |  Premium Slot ve Casino Oyunları mrking100590.com",
            "ogType": "website",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "ogImage": "https://mrking100590.com/og-image.jpg",
            "ogTitle": "MRKING100590 Dünyanın ve Türkiye’nin En Büyük Online Casino Platformu ! |  Premium Slot ve Casino Oyunları mrking100590.com",
            "ogSiteName": "mrking100590.com",
            "description": "MRKING100590, Türkiye'de rakipsiz premium en iyi casino ve slot deneyimi yaşayabileceğiniz online canlı bahis sitesi. mrking100590.com giriş için tıkla!",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://mrking100590.com/tr/",
            "ogDescription": "MRKING100590, Türkiye'de rakipsiz premium en iyi casino ve slot deneyimi yaşayabileceğiniz online canlı bahis sitesi. mrking100590.com giriş için tıkla!"
        },
        "trackers": {
            "requests": 62,
            "trackers": [
                {
                    "name": "Smartsupp Chat",
                    "company": "Smartsuppp",
                    "country": "CZ",
                    "category": "Customer Interaction",
                    "requests": 2
                },
                {
                    "name": "jQuery",
                    "company": "JS Foundation",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/swiper@11/swiper-bundle.min.js"
            ],
            "third_party_scripts": 2
        },
        "status": {
            "up": true,
            "code": 301,
            "timings": {
                "dns": 4,
                "tls": 55,
                "wait": 84,
                "connect": 6,
                "download": 1
            },
            "response_ms": 150
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 168757,
            "co2_grams": 0.0062,
            "cleaner_than": 11
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.204",
                    "host": "javier.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.101",
                    "host": "nataly.ns.cloudflare.com"
                }
            ],
            "zone": "mrking100590.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSESSID",
                    "secure": true,
                    "session": true
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "mrking100590.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "nataly.ns.cloudflare.com",
                "javier.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"javier.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418450735, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://mrking100590.com",
                "https://mrking100590.com/tr/"
            ],
            "count": 1
        },
        "linked_pages": {
            "internal_count": 68
        },
        "whois": {
            "registrar": "Key-Systems GmbH",
            "created": "2026-10-22T20:12:23Z",
            "updated": "2026-10-25T17:37:58Z",
            "expires": "2027-10-22T20:12:23Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "javier.ns.cloudflare.com",
                "nataly.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```