# PhishDestroy domain threat record: mrking110220.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mrking110220.com/
Machine-readable companion: https://phishdestroy.io/domain/mrking110220.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-28 11:49:22 UTC
- Stored record updated: 2026-10-28 12:11:12 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.91.169
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED

## Evidence links

- URLScan report: https://urlscan.io/result/01a18257-2130-77dc-b39a-87ddbcda7e3a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mrking110220.com
- Certificate Transparency search: https://crt.sh/?q=%25.mrking110220.com
- Web Archive lookup: https://web.archive.org/web/*/https://mrking110220.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed mrking110220.com as a suspicious domain with no confirmed malicious activity. The domain was first seen by PhishDestroy on 2026-10-28. An HTTP request on that date returned a 403 status and Cloudflare blocked the page, preventing further content assessment.

How the scam works
Because the page could not be retrieved, no specific phishing or fraud technique can be demonstrated for this site. Newly registered domains are sometimes used to host deceptive pages that aim to harvest credentials or lure users into financial scams, but no such behavior was observed here.

Evidence
VirusTotal scanned the domain on 2026-10-28 and reported zero detections from 92 engines. Google Safe Browsing checked on the same date and did not flag the domain. urlscan.io captured a redirect to HTTPS and a 403 response on 2026-10-28; its machine‑learning engine assigned a malicious score of 78, but the overall verdict was clean. No external blocklists reported the domain, OTX listed zero pulses, and PhishDestroy’s internal list marks it as suspicious.

Infrastructure
The domain was registered on 2026-10-28 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The recorded DNS records listed Cloudflare IP addresses 104.21.91.169 and 172.67.175.206 (and IPv6 addresses 2606:4700:3037::6815:5ba9 and 2606:4700:3032::ac43:afce) and used Cloudflare’s nameservers aspen.ns.cloudflare.com and jay.ns.cloudflare.com. A Let’s Encrypt TLS certificate covering mrking110220.com was observed, valid from 2026-10-28 to 2027-01-26, and DNSSEC was not enabled.

What to do
Visiting the site does not prove compromise, but anyone who submitted credentials should change passwords and enable multi‑factor authentication. Organizations should block the domain and monitor network logs for connections to the recorded IP addresses or hostnames. Continue to watch for future activity, as the lack of current evidence does not guarantee safety.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a18257-2130-77dc-b39a-87ddbcda7e3a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/a2420d51-b8bf-4411-9a60-76effb5a7889
Stored capture screenshot: https://urlscan.io/screenshots/01a18257-2130-77dc-b39a-87ddbcda7e3a.png
Cloudflare Radar screenshot (2026-10-28T11:51:14Z): https://screenshots.phishdestroy.io/cf/a2420d51-b8bf-4411-9a60-76effb5a7889.png
VirusTotal report: https://www.virustotal.com/gui/domain/mrking110220.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrking110220.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 11:52:17 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a18257-2130-77dc-b39a-87ddbcda7e3a.png
  Captured: 2026-10-28 11:49:22 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a18257-2130-77dc-b39a-87ddbcda7e3a.png
  Source report: https://urlscan.io/result/01a18257-2130-77dc-b39a-87ddbcda7e3a/
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a18258-6e6e-7465-8c74-dde4f884209c.png
  Captured: 2026-10-28 11:50:01 UTC
  Source report: https://urlscan.io/result/01a18258-6e6e-7465-8c74-dde4f884209c/
  SHA-256: c72b2c2b53611d94715672302938f49ede03bd0e519cfd7fccb05a9dba1c849f
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a2420d51-b8bf-4411-9a60-76effb5a7889.png
  Captured: 2026-10-28 11:51:14 UTC
  Source report: https://radar.cloudflare.com/scan/a2420d51-b8bf-4411-9a60-76effb5a7889
  SHA-256: 39ccbdfd10c5b79b5a3a66c5fc624e60eea0c4b1c41e61efda4993b5b14cec2e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T11:51:26Z",
        "uuid": "01a18257-2130-77dc-b39a-87ddbcda7e3a",
        "scanned_at": "2026-10-28T11:48:36Z",
        "final_url": "https://mrking110220.com/",
        "status": 403,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://mrking110220.com/",
                "from": "http://mrking110220.com/",
                "status": 307
            }
        ],
        "ip": "172.67.175.206",
        "ips": [
            "172.67.175.206"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "727952181b4ea33f8fc6e78b8267508aad6b91d7f6ffe0f1acb0c897003e2958",
        "globals": [
            "_cf_translation"
        ],
        "tls": {
            "san": [
                "*.mrking110220.com",
                "mrking110220.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "mrking110220.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-26T09:49:54Z",
            "valid_from": "2026-10-28T09:49:55Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 78,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T11:51:29Z",
        "uuid": "a2420d51-b8bf-4411-9a60-76effb5a7889",
        "scanned_at": "2026-10-28T11:51:14Z",
        "final_url": "https://mrking110220.com/",
        "status": 403,
        "history": [
            {
                "url": "https://mrking110220.com/",
                "status": 403
            }
        ],
        "dom_hash": "11a3897f82dd5c71e053fdd08f745dfed630a911694965172c89e6f17585f6c3",
        "doc_hash": "7717e026b6d0ad8ec1711d5797d458490ba3664cc5c930b5b0ba1d5909bce6aa",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mrking110220.com",
                "type": "A",
                "value": "172.67.175.206"
            },
            {
                "name": "mrking110220.com",
                "type": "A",
                "value": "104.21.91.169"
            },
            {
                "name": "mrking110220.com",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:5ba9"
            },
            {
                "name": "mrking110220.com",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:afce"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.3",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-28T10:43:53Z",
            "updated": "2026-10-28T10:46:36Z",
            "expires": "2027-10-28T10:43:53Z",
            "nameservers": [
                "aspen.ns.cloudflare.com",
                "jay.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T11:51:07Z",
        "analysis_at": "2026-10-28T11:08:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-28T10:43:53Z",
        "expires": "2027-10-28T10:43:53Z",
        "updated": "2026-10-28T10:46:36Z",
        "first_seen": "2026-10-28T11:08:44Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aspen.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jay.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:afce"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:5ba9"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.91.169"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.175.206"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aspen.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-28T11:08:44Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.mrking110220.com",
                "mrking110220.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "651c631511ee5690fcd285e9542fe647dc",
            "sha256": "7f7234b43a1113934533863ddcd1183f4f0b98e9fe295df9be4930dbeaec4662",
            "subject": "mrking110220.com",
            "valid_to": "2027-01-26T09:49:54Z",
            "valid_from": "2026-10-28T09:49:55Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-28T10:43:53Z",
            "updated": "2026-10-28T10:43:53Z",
            "expires": "2027-10-28T10:43:53Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "aspen.ns.cloudflare.com",
                "jay.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-28T10:43:53Z",
                "registration": "2026-10-28T10:43:53Z",
                "registrar expiration": "2027-10-28T10:43:53Z",
                "last update of RDAP database": "2026-10-28T11:08:34Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T11:51:51Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mrking110220.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.109",
                    "host": "aspen.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.123",
                    "host": "jay.ns.cloudflare.com"
                }
            ],
            "zone": "mrking110220.com"
        },
        "location": {
            "ip": "2606:4700:3037::6815:5ba9",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "mrking110220.com"
        },
        "dns": {
            "A": [
                "104.21.91.169",
                "172.67.175.206"
            ],
            "NS": [
                "jay.ns.cloudflare.com",
                "aspen.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"aspen.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418670214, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3037::6815:5ba9",
                "2606:4700:3032::ac43:afce"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3032::ac43:afce",
            "family": 6
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-28T10:43:53Z",
            "updated": "2026-10-28T10:46:36Z",
            "expires": "2027-10-28T10:43:53Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "aspen.ns.cloudflare.com",
                "jay.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-frame-options": "SAMEORIGIN",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```