# PhishDestroy domain threat record: mrking11044.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mrking11044.com/
Machine-readable companion: https://phishdestroy.io/domain/mrking11044.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 09:39:23 UTC
- Last availability or vendor check: 2026-10-26 12:02:25 UTC
- Stored record updated: 2026-10-26 19:30:39 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.136.140
- Registrar in stored WHOIS data: Key-Systems GmbH
- Registrar country in stored WHOIS data: NL
- Last stored HTTP status: 403

## Evidence links

- URLScan report: https://urlscan.io/result/01a1726c-e9cf-734e-b58e-bf9d1708de84/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mrking11044.com
- Certificate Transparency search: https://crt.sh/?q=%25.mrking11044.com
- Web Archive lookup: https://web.archive.org/web/*/https://mrking11044.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added mrking11044.com to its internal blocklist on 2026-10-25 because the domain was registered the same day and showed no usable content. The intake system noted the domain as a "young" registration and recorded that the page returned a 403 status with a Cloudflare challenge, preventing further analysis. No page title or visible content was captured at the time of the check. The domain remains listed as suspicious pending further investigation.

How the scam works
A domain flagged as suspicious may be used for phishing, credential harvesting, or other fraud, but no specific malicious behavior was observed on this site. The 403 response and challenge indicate the operator is shielding the site, which is a common tactic to avoid automated analysis. Without visible content, the exact scheme cannot be determined, and the listing reflects risk based on age, detection signals, and external blocklist matches.

Evidence
VirusTotal scanned the domain on 2026-10-25 and recorded one malicious detection out of 92 engines, with PhishFort labeling it as phishing and a DGA tag applied. Google Safe Browsing checked the same day and did not flag the domain. Spamhaus DBL listed mrking11044.com as a phishing site on 2026-10-25. OTX reported four pulses referencing the domain, and urlscan.io’s engine marked it malicious with a score of 64, also noting the 403 response and Cloudflare challenge.

Infrastructure
The domain was registered on 2026-10-25 through Key‑Systems GmbH and uses Cloudflare’s DNS and CDN services, with A records pointing to 172.67.136.140 and 104.21.94.140 and AAAA records to 2606:4700:3036::6815:8e and 2606:4700:3033::ac43:888c. The TLS check recorded a Let's Encrypt certificate valid until 2027-01-23, and the recorded headers indicated Cloudflare’s WAF was active. DNSSEC is not enabled for the zone.

What to do
Do not enter credentials, personal data, or cryptocurrency information on mrking11044.com; the site’s intent is unverified. If you visited and submitted any login details, change those passwords immediately and monitor the associated accounts for suspicious activity. Defenders should block the exact domain and its recorded IPs in firewalls and monitor logs for any connections to the observed Cloudflare addresses.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1726c-e9cf-734e-b58e-bf9d1708de84/
Cloudflare Radar report: https://radar.cloudflare.com/scan/66c06547-e4fe-47cd-be63-2e439dc95f7a
URLQuery report: https://urlquery.net/report/4f6f4548-fff0-4aed-a01e-ec14d935bc9d
Stored capture screenshot: https://i.ibb.co/3Y9t5cZF/d29ea4316f8a.png
Cloudflare Radar screenshot (2026-10-25T10:11:09Z): https://screenshots.phishdestroy.io/cf/66c06547-e4fe-47cd-be63-2e439dc95f7a.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/4f6f4548-fff0-4aed-a01e-ec14d935bc9d.png
URLScan screenshot (2026-10-25T09:42:40Z): https://screenshots.phishdestroy.io/us/01a17270-af28-77d8-8988-02d7b7f0b9ce.png
URLScan capture report: https://urlscan.io/result/01a17270-af28-77d8-8988-02d7b7f0b9ce/
VirusTotal report: https://www.virustotal.com/gui/domain/mrking11044.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrking11044.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 15:28:36 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/3Y9t5cZF/d29ea4316f8a.png
  Captured: 2026-10-25 09:39:23 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1726c-e9cf-734e-b58e-bf9d1708de84.png
  Captured: 2026-10-25 09:39:23 UTC
  Source report: https://urlscan.io/result/01a1726c-e9cf-734e-b58e-bf9d1708de84/
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17270-af28-77d8-8988-02d7b7f0b9ce.png
  Captured: 2026-10-25 09:42:40 UTC
  Source report: https://urlscan.io/result/01a17270-af28-77d8-8988-02d7b7f0b9ce/
  SHA-256: 160e0e8afe20ca439e968ccc709dcfbe2a48a1a20fe5b34341667a846143ae30
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/66c06547-e4fe-47cd-be63-2e439dc95f7a.png
  Captured: 2026-10-25 10:11:09 UTC
  Source report: https://radar.cloudflare.com/scan/66c06547-e4fe-47cd-be63-2e439dc95f7a
  SHA-256: 1c2ae89823a1e90e9c43ed1c122598b42292dabbcfee6ad6a66eb4d16f772037
- URLQuery: https://screenshots.phishdestroy.io/uq/4f6f4548-fff0-4aed-a01e-ec14d935bc9d.png
  Source report: https://urlquery.net/report/4f6f4548-fff0-4aed-a01e-ec14d935bc9d
  SHA-256: ccd8883c1c18f9424d5b029b18c9e23529bace595871336bf7ac15fbb6329d40

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T10:12:28Z",
        "uuid": "01a1726c-e9cf-734e-b58e-bf9d1708de84",
        "scanned_at": "2026-10-25T09:38:32Z",
        "final_url": "https://mrking11044.com/",
        "status": 403,
        "redirects": [
            {
                "to": "https://mrking11044.com/",
                "from": "https://mrking11044.com/",
                "status": 307
            }
        ],
        "ip": "172.67.136.140",
        "domains": [
            "challenges.cloudflare.com"
        ],
        "ips": [
            "104.18.94.41",
            "104.18.95.41",
            "172.67.136.140"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "b9677259f1764fba78150b57df727ca376fa67b65b1120d40c340de7b402168d",
        "script_hashes": [
            "a4a0369c274e83b087f4e431486dcf9f8dd701ec7aa4438c2ebbda7040fbdad2"
        ],
        "globals": [
            "_cf_chl_opt",
            "runProgram",
            "AGRfA7",
            "qrht8",
            "LeviO5",
            "qpPe1",
            "atAFr0",
            "SABtz7",
            "FIac3",
            "RpzJz6",
            "QSqpx9",
            "ueZh9",
            "FBBK4",
            "ZliED2",
            "HKul9",
            "THirw9",
            "IXEYu6",
            "nOLY0",
            "DraY9",
            "vyix0",
            "uEeN6",
            "NmGWd6",
            "vUAjb0",
            "zCGb4",
            "nTlR0",
            "AwUcP3",
            "MkvrI5",
            "MpSwI7",
            "xrbo0",
            "vMhC1",
            "angular",
            "vvfHL3",
            "lffN9",
            "dSvRK1",
            "turnstile",
            "QBEM0",
            "AgLL2",
            "wEyW4",
            "THSr2"
        ],
        "tls": {
            "san": [
                "*.mrking11044.com",
                "mrking11044.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "mrking11044.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-23T07:28:52Z",
            "valid_from": "2026-10-25T07:28:53Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 9,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 64,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "content-security-policy": "default-src 'none'; script-src 'nonce-Viu8sahhTspb3cEj2MeRqc' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.clou",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin",
            "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s",
            "cross-origin-opener-policy": "same-origin",
            "cross-origin-resource-policy": "same-origin",
            "cross-origin-embedder-policy": "require-corp"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T10:12:30Z",
        "uuid": "66c06547-e4fe-47cd-be63-2e439dc95f7a",
        "scanned_at": "2026-10-25T10:11:09Z",
        "final_url": "https://mrking11044.com/",
        "status": 403,
        "history": [
            {
                "url": "https://mrking11044.com/",
                "status": 403
            }
        ],
        "dom_hash": "9b0956dce985a1d6b8f18fbb19e60968c1afcc397d1b2ce78fe9fc0e0f4b6be2",
        "doc_hash": "c456a61eae44cb21f1af0b3efa6cd7b3a92791008ad9e75af5a903d3ca7ab91f",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mrking11044.com",
                "type": "A",
                "value": "172.67.136.140"
            },
            {
                "name": "mrking11044.com",
                "type": "A",
                "value": "104.21.94.140"
            },
            {
                "name": "mrking11044.com",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:888c"
            },
            {
                "name": "mrking11044.com",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:5e8c"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.136.140",
        "whois": {
            "registrar": "Key-Systems GmbH",
            "created": "2026-10-25T08:21:16Z",
            "updated": "2026-10-25T08:22:08Z",
            "expires": "2027-10-25T08:21:16Z",
            "nameservers": [
                "ignat.ns.cloudflare.com",
                "miki.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T15:24:26Z",
        "analysis_at": "2026-10-25T11:21:28Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "PhishFort": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Key-Systems GmbH",
        "created": "2026-10-25T08:21:16Z",
        "expires": "2027-10-25T08:21:16Z",
        "updated": "2026-10-25T08:22:08Z",
        "first_seen": "2026-10-25T08:31:57Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "miki.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.136.140"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:5e8c"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:888c"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ignat.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "ignat.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.94.140"
            }
        ],
        "dns_at": "2026-10-25T11:36:10Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.mrking11044.com",
                "mrking11044.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6c4f2e765dea6658ee093dcf7d70185d86d",
            "sha256": "d28fc4c4b1997c7a7c8efa9327f9885ac4f05a03aa9eff2f886d22a9560c96a7",
            "subject": "mrking11044.com",
            "valid_to": "2027-01-23T07:28:52Z",
            "valid_from": "2026-10-25T07:28:53Z"
        },
        "whois": {
            "registrar": "Key-Systems GmbH",
            "registrar_iana_id": "269",
            "registrar_url": "-",
            "created": "2026-10-25T08:21:16Z",
            "updated": "2026-10-25T08:22:08Z",
            "expires": "2027-10-25T08:21:16Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ignat.ns.cloudflare.com",
                "miki.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-25T08:21:16Z",
                "last changed": "2026-10-25T08:22:08Z",
                "registration": "2026-10-25T08:21:16Z",
                "registrar expiration": "2027-10-25T08:21:16Z",
                "last update of RDAP database": "2026-10-25T08:31:47Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T10:12:51Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mrking11044.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.19",
                    "host": "ignat.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.32.202",
                    "host": "miki.ns.cloudflare.com"
                }
            ],
            "zone": "mrking11044.com"
        },
        "location": {
            "ip": "2606:4700:3033::ac43:888c",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "mrking11044.com"
        },
        "dns": {
            "A": [
                "104.21.94.140",
                "172.67.136.140"
            ],
            "NS": [
                "miki.ns.cloudflare.com",
                "ignat.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"ignat.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418405820, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3036::6815:5e8c",
                "2606:4700:3033::ac43:888c"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3036::6815:5e8c",
            "family": 6
        },
        "whois": {
            "registrar": "Key-Systems GmbH",
            "created": "2026-10-25T08:21:16Z",
            "updated": "2026-10-25T08:22:08Z",
            "expires": "2027-10-25T08:21:16Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ignat.ns.cloudflare.com",
                "miki.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "content-security-policy": "default-src 'none'; script-src 'nonce-jy8KNWBUSQFIbmyvJOVUUn' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin",
                "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*",
                "cross-origin-opener-policy": "same-origin",
                "cross-origin-resource-policy": "same-origin",
                "cross-origin-embedder-policy": "require-corp"
            }
        }
    }
}
```