# PhishDestroy domain threat record: mrking11083.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mrking11083.com/
Machine-readable companion: https://phishdestroy.io/domain/mrking11083.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-21 22:42:34 UTC
- Last availability or vendor check: 2026-10-22 10:39:52 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Key-Systems GmbH
- Registrar country in stored WHOIS data: NL
- Last stored HTTP status: 403
- Registration date (registry RDAP, mrking11083.com): 2026-10-21 18:59:15 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a160a0-818c-754d-8ce5-32a5ea4a6013/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mrking11083.com
- Certificate Transparency search: https://crt.sh/?q=%25.mrking11083.com
- Web Archive lookup: https://web.archive.org/web/*/https://mrking11083.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added mrking11083.com to its internal blocklist on 2026-10-22. The intake system flagged the domain because it was registered only one day earlier (2026-10-21) and the HTTP request returned a 403 Forbidden status together with a Cloudflare challenge, preventing any page content from being observed.

How the scam works
A domain that only presents a Cloudflare challenge can be used to hide malicious pages until a visitor solves the challenge, a technique commonly employed in phishing or credential‑harvesting campaigns. Because the page content was not visible, PhishDestroy cannot confirm a specific payload, only that the observed behavior matches a pattern often leveraged by fraudsters.

Evidence
VirusTotal scanned the domain on 2026-10-22 with 92 engines and reported zero malicious or suspicious detections, labeling it only with the generic “dga” tag. Google Safe Browsing checked the same day and did not flag the URL. OTX listed four pulses referencing the domain, and urlscan.io recorded a 403 response but its machine‑learning engine assigned a malicious score of 67, while the overall verdict remained non‑malicious. PhishDestroy’s own blocklist also marks the domain as suspicious.

Infrastructure
The domain was registered through Key‑Systems GmbH on 2026-10-21 and uses Cloudflare’s CDN, resolving to IP addresses such as 188.114.96.3 and 188.114.96.9 in Canada. TLS is provided by a Let’s Encrypt certificate valid until 2027-01-19, and the authoritative nameservers are ignat.ns.cloudflare.com and miki.ns.cloudflare.com. No additional hosting or registrar information suggests a particular operator.

What to do
Visitors should avoid submitting any credentials or personal data to the site and should change passwords if they have already entered them. Organizations can block the domain at the DNS or proxy level and monitor logs for connections to the listed Cloudflare IPs. Continue to watch threat‑intel feeds for any future activity linked to mrking11083.com.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a160a0-818c-754d-8ce5-32a5ea4a6013/
URLQuery report: https://urlquery.net/report/5b07a92a-3ba5-4638-9c7f-d92c9552c417
Stored capture screenshot: https://i.ibb.co/KcPQ45v6/8de3ec233524.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/5b07a92a-3ba5-4638-9c7f-d92c9552c417.png
URLScan screenshot (2026-10-21T22:46:47Z): https://screenshots.phishdestroy.io/us/01a160a5-23be-775d-a193-7bd37fa5745e.png
URLScan capture report: https://urlscan.io/result/01a160a5-23be-775d-a193-7bd37fa5745e/
VirusTotal report: https://www.virustotal.com/gui/domain/mrking11083.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrking11083.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 23:43:42 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/KcPQ45v6/8de3ec233524.png
  Captured: 2026-10-21 22:42:34 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a160a0-818c-754d-8ce5-32a5ea4a6013.png
  Captured: 2026-10-21 22:42:34 UTC
  Source report: https://urlscan.io/result/01a160a0-818c-754d-8ce5-32a5ea4a6013/
- URLQuery: https://screenshots.phishdestroy.io/uq/5b07a92a-3ba5-4638-9c7f-d92c9552c417.png
  Source report: https://urlquery.net/report/5b07a92a-3ba5-4638-9c7f-d92c9552c417
  SHA-256: 5c8ba989e408b47fefb10f05dc8de9b293660c972030b22ceee153e3155afd77
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a160a5-23be-775d-a193-7bd37fa5745e.png
  Captured: 2026-10-21 22:46:47 UTC
  Source report: https://urlscan.io/result/01a160a5-23be-775d-a193-7bd37fa5745e/
  SHA-256: cd4ca0a76e0eccb882a8cf1fa445aea0ca112d85bdab18fd635ffda5b1ca6359

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T22:44:32Z",
        "uuid": "01a160a0-818c-754d-8ce5-32a5ea4a6013",
        "scanned_at": "2026-10-21T22:41:44Z",
        "final_url": "https://mrking11083.com/",
        "status": 403,
        "redirects": [
            {
                "to": "https://mrking11083.com/",
                "from": "https://mrking11083.com/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "challenges.cloudflare.com"
        ],
        "ips": [
            "104.18.94.41",
            "104.18.95.41",
            "188.114.96.3"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "c37bcb611e197ec2590fb4acd79548beccd976929bb78b6e14488379180b95b7",
        "script_hashes": [
            "3821ad5f21a2b63582f0ab6a5304418ce7e7a66f89308da16e67d42a1ea78d86"
        ],
        "globals": [
            "_cf_chl_opt",
            "runProgram",
            "NmGWd6",
            "AGRfA7",
            "qrht8",
            "LeviO5",
            "qpPe1",
            "atAFr0",
            "SABtz7",
            "FIac3",
            "RpzJz6",
            "QSqpx9",
            "ueZh9",
            "FBBK4",
            "ZliED2",
            "HKul9",
            "THirw9",
            "IXEYu6",
            "nOLY0",
            "DraY9",
            "vyix0",
            "uEeN6",
            "vUAjb0",
            "zCGb4",
            "nTlR0",
            "AwUcP3",
            "MkvrI5",
            "MpSwI7",
            "xrbo0",
            "vMhC1",
            "angular",
            "vvfHL3",
            "lffN9",
            "dSvRK1",
            "turnstile",
            "QBEM0",
            "AgLL2",
            "wEyW4",
            "THSr2"
        ],
        "tls": {
            "san": [
                "*.mrking11083.com",
                "mrking11083.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "mrking11083.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-19T21:10:02Z",
            "valid_from": "2026-10-21T21:10:03Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 9,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 67,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "content-security-policy": "default-src 'none'; script-src 'nonce-irPAvkpefOX9xZlG6ylS3t' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.clou",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin",
            "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s",
            "cross-origin-opener-policy": "same-origin",
            "cross-origin-resource-policy": "same-origin",
            "cross-origin-embedder-policy": "require-corp"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T23:43:22Z",
        "analysis_at": "2026-10-21T23:13:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Key-Systems GmbH",
        "created": "2026-10-21T18:59:15Z",
        "expires": "2027-10-21T18:59:15Z",
        "updated": "2026-10-21T21:17:36Z",
        "first_seen": "2026-10-21T22:14:36Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.166.77"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "drew.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "drew.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "venus.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.42.211"
            }
        ],
        "dns_at": "2026-10-21T23:18:29Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "*.mrking11083.com",
                "mrking11083.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "668ff75252f923b885d5dd689d6f84a42f4",
            "sha256": "9382a5eb525b3cb574c73fb63a36757bd083d156eb6749cfc54ab8e29fa0bce3",
            "subject": "mrking11083.com",
            "valid_to": "2027-01-19T22:06:07Z",
            "valid_from": "2026-10-21T22:06:08Z"
        },
        "whois": {
            "registrar": "Key-Systems GmbH",
            "registrar_iana_id": "269",
            "registrar_url": "-",
            "created": "2026-10-21T18:59:15Z",
            "updated": "2026-10-21T21:17:36Z",
            "expires": "2027-10-21T18:59:15Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ignat.ns.cloudflare.com",
                "miki.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-21T18:59:15Z",
                "last changed": "2026-10-21T21:17:36Z",
                "registration": "2026-10-21T18:59:15Z",
                "registrar expiration": "2027-10-21T18:59:15Z",
                "last update of RDAP database": "2026-10-21T22:14:26Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T22:44:44Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mrking11083.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.19",
                    "host": "ignat.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.192.202",
                    "host": "miki.ns.cloudflare.com"
                }
            ],
            "zone": "mrking11083.com"
        },
        "location": {
            "ip": "188.114.97.9",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "mrking11083.com"
        },
        "dns": {
            "A": [
                "188.114.96.9",
                "188.114.97.9"
            ],
            "NS": [
                "miki.ns.cloudflare.com",
                "ignat.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"ignat.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418106223, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "188.114.96.9",
            "family": 4
        },
        "tech_stack": {
            "technologies": [
                "AngularJS",
                "Cloudflare Turnstile",
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "Key-Systems GmbH",
            "created": "2026-10-21T18:59:15Z",
            "updated": "2026-10-21T21:17:36Z",
            "expires": "2027-10-21T18:59:15Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ignat.ns.cloudflare.com",
                "miki.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "content-security-policy": "default-src 'none'; script-src 'nonce-dKJpim6u7A4GhjqcfiAdM9' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin",
                "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*",
                "cross-origin-opener-policy": "same-origin",
                "cross-origin-resource-policy": "same-origin",
                "cross-origin-embedder-policy": "require-corp"
            }
        }
    }
}
```