# PhishDestroy domain threat record: mrking11081.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/mrking11081.com/ Machine-readable companion: https://phishdestroy.io/domain/mrking11081.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 10:38:10 UTC - Last availability or vendor check: 2026-10-26 11:00:21 UTC - Stored record updated: 2026-10-26 21:16:27 UTC - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.63.164 - Registrar in stored WHOIS data: Key-Systems GmbH - Last stored HTTP status: 403 ## Evidence links - URLScan report: https://urlscan.io/result/01a177c9-679c-75ab-ae2d-a0e785bf9575/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/mrking11081.com - Certificate Transparency search: https://crt.sh/?q=%25.mrking11081.com - Web Archive lookup: https://web.archive.org/web/*/https://mrking11081.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed mrking11081.com as a suspicious domain based on its novelty and scan results. The site returned an HTTP 403 status on 2026-10-26, the same day it was first seen by PhishDestroy. No page title was recorded during the scan. How the scam works No specific fraud technique was observed on the page. The listing reflects a risk assessment that newly registered domains behind CDNs can be used for phishing, credential harvesting, or fraudulent redirects, but the current evidence does not confirm any of those behaviors. Evidence Google Safe Browsing checked the domain on 2026-10-26 and did not flag it. External blocklists showed zero hits on the same date, and OTX reported no pulses. URLScan captured the site on 2026-10-26, returned a 403 status, and its engine verdict marked the URL as malicious with a score of 78, while the overall verdict was non‑malicious. Cloudflare Radar also flagged the domain on 2026-10-26 as a newly seen domain with security risks. PhishDestroy’s internal blocklist includes the domain as of 2026-10-26. Infrastructure The domain was registered on 2026-10-26 through Key-Systems GmbH. The recorded DNS records listed two A addresses (104.21.63.164 and 172.67.171.16) and two AAAA addresses (2606:4700:3033::6815:3fa4 and 2606:4700:3034::ac43:ab10). TLS was issued by Let’s Encrypt / YE1 on 2026-10-26, valid until 2027-01-24, and the server header reported "cloudflare" with a Cloudflare WAF enabled. No DNSSEC records were present. What to do Visitors should avoid entering any credentials or personal data on the site; if any were submitted, change the associated passwords and monitor accounts for unusual activity. Defenders should block the exact domain mrking11081.com in firewalls or proxy filters and review logs for connections to the recorded IP addresses. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a177c9-679c-75ab-ae2d-a0e785bf9575/ Cloudflare Radar report: https://radar.cloudflare.com/scan/97dfd7ee-add0-4a4b-a943-a26d69cf2de0 Stored capture screenshot: https://urlscan.io/screenshots/01a177c9-679c-75ab-ae2d-a0e785bf9575.png Cloudflare Radar screenshot (2026-10-26T10:38:35Z): https://screenshots.phishdestroy.io/cf/97dfd7ee-add0-4a4b-a943-a26d69cf2de0.png URLScan screenshot (2026-10-26T10:38:40Z): https://screenshots.phishdestroy.io/us/01a177ca-4f4f-7058-967f-618f7cee89eb.png URLScan capture report: https://urlscan.io/result/01a177ca-4f4f-7058-967f-618f7cee89eb/ VirusTotal report: https://www.virustotal.com/gui/domain/mrking11081.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrking11081.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 10:39:19 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a177c9-679c-75ab-ae2d-a0e785bf9575.png Captured: 2026-10-26 10:38:10 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a177c9-679c-75ab-ae2d-a0e785bf9575.png Source report: https://urlscan.io/result/01a177c9-679c-75ab-ae2d-a0e785bf9575/ - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a177ca-4f4f-7058-967f-618f7cee89eb.png Captured: 2026-10-26 10:38:40 UTC Source report: https://urlscan.io/result/01a177ca-4f4f-7058-967f-618f7cee89eb/ SHA-256: 62cdb1ebefc089a6875ec9734829b6dbb1e3d3ce5416713b3d9b83641bc3c63c - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/97dfd7ee-add0-4a4b-a943-a26d69cf2de0.png Captured: 2026-10-26 10:38:35 UTC Source report: https://radar.cloudflare.com/scan/97dfd7ee-add0-4a4b-a943-a26d69cf2de0 SHA-256: da14875dd04b9b74a54e395bcc669147ea94834d6f907726b362348726a6cb98 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T10:38:45Z", "uuid": "01a177c9-679c-75ab-ae2d-a0e785bf9575", "scanned_at": "2026-10-26T10:37:40Z", "final_url": "https://mrking11081.com/", "status": 403, "redirected": "https-only", "redirects": [ { "to": "https://mrking11081.com/", "from": "http://mrking11081.com/", "status": 307 } ], "ip": "172.67.171.16", "ips": [ "172.67.171.16" ], "asns": [ "13335" ], "link_domains": [ "www.cloudflare.com" ], "doc_hash": "846f6cfe00611d470904eeaacad40e71c9fdf208831be715ada9563de99302c4", "globals": [ "_cf_translation" ], "tls": { "san": [ "*.mrking11081.com", "mrking11081.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "mrking11081.com", "protocol": "QUIC", "valid_to": "2027-01-24T09:35:00Z", "valid_from": "2026-10-26T09:35:01Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 78, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "referrer-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T10:38:50Z", "uuid": "97dfd7ee-add0-4a4b-a943-a26d69cf2de0", "scanned_at": "2026-10-26T10:38:35Z", "final_url": "https://mrking11081.com/", "status": 403, "history": [ { "url": "https://mrking11081.com/", "status": 403 } ], "dom_hash": "11a3897f82dd5c71e053fdd08f745dfed630a911694965172c89e6f17585f6c3", "doc_hash": "8f33afb9c02f3d62ee1a9161a153cdb856568b15ae45770a34ea925470664915", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "mrking11081.com", "type": "A", "value": "104.21.63.164" }, { "name": "mrking11081.com", "type": "A", "value": "172.67.171.16" }, { "name": "mrking11081.com", "type": "AAAA", "value": "2606:4700:3033::6815:3fa4" }, { "name": "mrking11081.com", "type": "AAAA", "value": "2606:4700:3034::ac43:ab10" } ], "dnssec_valid": false, "ip": "104.21.63.164", "whois": { "registrar": "Key-Systems GmbH", "created": "2026-10-26T10:29:25Z", "updated": "2026-10-26T10:31:02Z", "expires": "2027-10-26T10:29:25Z", "nameservers": [ "ignat.ns.cloudflare.com", "miki.ns.cloudflare.com" ] } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T10:38:59Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "mrking11081.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "dns_server": { "ns": [ { "ip": "108.162.192.202", "host": "miki.ns.cloudflare.com" }, { "ip": "172.64.35.19", "host": "ignat.ns.cloudflare.com" } ], "zone": "mrking11081.com" }, "location": { "ip": "2606:4700:3034::ac43:ab10", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "mrking11081.com" }, "dns": { "A": [ "104.21.63.164", "172.67.171.16" ], "NS": [ "ignat.ns.cloudflare.com", "miki.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"ignat.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418496553, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3033::6815:3fa4", "2606:4700:3034::ac43:ab10" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "same-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3033::6815:3fa4", "family": 6 }, "whois": { "registrar": "Key-Systems GmbH", "created": "2026-10-26T10:29:25Z", "updated": "2026-10-26T10:31:02Z", "expires": "2027-10-26T10:29:25Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ignat.ns.cloudflare.com", "miki.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "referrer-policy": "same-origin" } } } } ```