# PhishDestroy domain threat record: mrking19059.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mrking19059.com/
Machine-readable companion: https://phishdestroy.io/domain/mrking19059.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 19:30:31 UTC
- Stored record updated: 2026-10-26 21:11:01 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED

## Evidence links

- URLScan report: https://urlscan.io/result/01a179ae-a04e-7449-aafd-7cd17994078d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mrking19059.com
- Certificate Transparency search: https://crt.sh/?q=%25.mrking19059.com
- Web Archive lookup: https://web.archive.org/web/*/https://mrking19059.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a dark full-screen Turkish interstitial headed "Güvenlik doğrulaması", with a spinner and the text "Doğrulama tamamlanamadı. Lütfen sayfayı yenileyin.", meaning the verification did not complete. No form fields, buttons, offers or impersonated brand appeared in the capture. PhishDestroy listed the domain because it was newly registered and first seen on 2026-10-26.

How the scam works
The page worked as a bot-verification gate: it claimed a security check was running, failed, and asked the visitor to refresh, conditioning them to clear a challenge before any following content could appear. No credential or payment form was observed in this capture, so the interstitial is reported as a category risk common to scam landings that hide behind challenge screens. No wallet-connect prompt, offer or brand impersonation was visible.

Evidence
The screenshot itself shows only the Turkish verification text, spinner and refresh instruction, with no data-entry fields. urlscan's machine-learning engine scored the capture 55 and marked it malicious on 2026-10-26, while the overall urlscan verdict remained clean, recording HTTP 403, a Cloudflare challenge and 21 requests. VirusTotal did not flag the domain on 2026-10-26 and Google Safe Browsing did not flag it either; OTX recorded 0 pulses, external blocklists 0 entries, while PhishDestroy's internal blocklist flagged it and none of 12 DNS resolvers blocked it. The redirect funnel was a 307 to HTTPS with no cross-site redirect; inspection found Cloudflare challenge globals rather than an application framework, no analytics or trackers, and 2 distinct script SHA256 hashes recorded for pivoting (first 446d0f90f5bc).

Infrastructure
Registered 2026-10-26 via NICENIC INTERNATIONAL GROUP CO., LIMITED on Cloudflare nameservers behind a Cloudflare WAF. Notable weaknesses: CSP, HSTS, X-Content-Type-Options, Permissions-Policy, COOP, COEP and CORP all absent; X-Frame-Options SAMEORIGIN and Referrer-Policy same-origin present; TLS 1.3, TLS-AES-256-GCM-SHA384, forward secrecy, ALPN h2; no SPF lookups, no DKIM or DMARC; CAA record present; DNSSEC unsigned.

What to do
If you entered credentials or personal data through mrking19059.com, change the password on the genuine service you used and enable 2FA, and treat any follow-up messages as suspicious. Defenders should block only mrking19059.com at proxy and DNS controls and flag freshly registered domains presenting verification gates under this pattern.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a179ae-a04e-7449-aafd-7cd17994078d/
Cloudflare Radar report: https://radar.cloudflare.com/scan/fdf1fd7a-b132-4e53-838e-1201ea4bc6da
Stored capture screenshot: https://urlscan.io/screenshots/01a179ae-a04e-7449-aafd-7cd17994078d.png
Cloudflare Radar screenshot (2026-10-26T19:39:42Z): https://screenshots.phishdestroy.io/cf/fdf1fd7a-b132-4e53-838e-1201ea4bc6da.png
URLScan screenshot (2026-10-26T19:17:35Z): https://screenshots.phishdestroy.io/us/01a179a4-1895-7428-b711-987cd775f636.png
URLScan capture report: https://urlscan.io/result/01a179a4-1895-7428-b711-987cd775f636/
URLScan screenshot (2026-10-26T19:31:17Z): https://screenshots.phishdestroy.io/us/01a179b1-d20f-76c8-8305-45531ae26369.png
URLScan capture report: https://urlscan.io/result/01a179b1-d20f-76c8-8305-45531ae26369/
URLScan screenshot (2026-10-26T19:31:45Z): https://screenshots.phishdestroy.io/us/01a179b2-65ab-729b-a651-d6f1d2a01344.png
URLScan capture report: https://urlscan.io/result/01a179b2-65ab-729b-a651-d6f1d2a01344/
VirusTotal report: https://www.virustotal.com/gui/domain/mrking19059.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrking19059.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:37:06 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a179ae-a04e-7449-aafd-7cd17994078d.png
  Captured: 2026-10-26 19:30:31 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a179ae-a04e-7449-aafd-7cd17994078d.png
  Source report: https://urlscan.io/result/01a179ae-a04e-7449-aafd-7cd17994078d/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179a4-1895-7428-b711-987cd775f636.png
  Captured: 2026-10-26 19:17:35 UTC
  Source report: https://urlscan.io/result/01a179a4-1895-7428-b711-987cd775f636/
  SHA-256: bc7673e9dcb2028584edcb00374f249a8ecf98d014633dafa3beb96821d34ffc
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179b1-d20f-76c8-8305-45531ae26369.png
  Captured: 2026-10-26 19:31:17 UTC
  Source report: https://urlscan.io/result/01a179b1-d20f-76c8-8305-45531ae26369/
  SHA-256: 31b0e5d369847122759f87541af33327237f3c66dc98946196aef112d2f09c44
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179b2-65ab-729b-a651-d6f1d2a01344.png
  Captured: 2026-10-26 19:31:45 UTC
  Source report: https://urlscan.io/result/01a179b2-65ab-729b-a651-d6f1d2a01344/
  SHA-256: ac0862b43c51f901f2125d0341de519ef384c91815a681d5d2f14329fdb08f6d
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fdf1fd7a-b132-4e53-838e-1201ea4bc6da.png
  Captured: 2026-10-26 19:39:42 UTC
  Source report: https://radar.cloudflare.com/scan/fdf1fd7a-b132-4e53-838e-1201ea4bc6da
  SHA-256: 1f836b5d4ee4f490ec2ceb09e9c9503a69eddde566d1cbf254c44cc9b017c225

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T19:41:56Z",
        "uuid": "01a179ae-a04e-7449-aafd-7cd17994078d",
        "scanned_at": "2026-10-26T19:27:38Z",
        "final_url": "https://mrking19059.com/",
        "status": 403,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://mrking19059.com/",
                "from": "http://mrking19059.com/",
                "status": 307
            },
            {
                "to": "https://mrking19059.com/",
                "from": "https://mrking19059.com/",
                "status": 307
            },
            {
                "to": "https://mrking19059.com/",
                "from": "https://mrking19059.com/"
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "challenges.cloudflare.com"
        ],
        "ips": [
            "104.18.94.41",
            "188.114.97.3",
            "2a06:98c1:3121::3"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "24361ac4cecf7fc2272251e2e1b7d10e0db9a6f02885a2c760e0b2a672daf82d",
        "script_hashes": [
            "446d0f90f5bc45a1c833cf5cf1574494f382f21ca9f02e70a9b1ed198cba9bd6",
            "67fb95ab0e5b6e922f00799d944b58ab6a0c5d39d1e31794a50b42f7ace52063"
        ],
        "globals": [
            "_cf_chl_opt",
            "runProgram",
            "THirw9",
            "IXEYu6",
            "nOLY0",
            "DraY9",
            "vyix0",
            "uEeN6",
            "AGRfA7",
            "qrht8",
            "LeviO5",
            "qpPe1",
            "atAFr0",
            "SABtz7",
            "FIac3",
            "RpzJz6",
            "QSqpx9",
            "ueZh9",
            "FBBK4",
            "ZliED2",
            "HKul9",
            "NmGWd6",
            "vUAjb0",
            "zCGb4",
            "nTlR0",
            "AwUcP3",
            "MkvrI5",
            "MpSwI7",
            "xrbo0",
            "vMhC1",
            "angular",
            "vvfHL3",
            "lffN9",
            "dSvRK1",
            "turnstile",
            "QBEM0",
            "AgLL2",
            "wEyW4",
            "THSr2",
            "coTgT4"
        ],
        "cookies": [
            "cf_clearance",
            "cf_chl_rc_ni"
        ],
        "tls": {
            "san": [
                "*.mrking19059.com",
                "mrking19059.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "mrking19059.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-24T18:16:41Z",
            "valid_from": "2026-10-26T18:16:42Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 21,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 55,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "content-security-policy": "default-src 'none'; script-src 'nonce-b9XfzyTeu8tCbZ5MZt9EWO' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.clou",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin",
            "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s",
            "cross-origin-opener-policy": "same-origin",
            "cross-origin-resource-policy": "same-origin",
            "cross-origin-embedder-policy": "require-corp"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T19:41:57Z",
        "uuid": "fdf1fd7a-b132-4e53-838e-1201ea4bc6da",
        "scanned_at": "2026-10-26T19:39:42Z",
        "final_url": "https://mrking19059.com/",
        "status": 429,
        "history": [
            {
                "url": "https://mrking19059.com/",
                "status": 429
            }
        ],
        "dom_hash": "2e19d90358fe326964aeb43e87ecd21bcb780df733015263b3119e100ab4a58d",
        "doc_hash": "0bd923b429fff190cbf5f5828447ff3a104b7596d6051804d912c956661a0c35",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mrking19059.com",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "mrking19059.com",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "mrking19059.com",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "mrking19059.com",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.96.0",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-26T19:12:03Z",
            "updated": "2026-10-26T19:12:03Z",
            "expires": "2027-10-26T19:12:03Z",
            "nameservers": [
                "josh.ns.cloudflare.com",
                "leia.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T19:39:29Z",
        "analysis_at": "2026-10-26T19:22:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-26T19:12:03Z",
        "expires": "2027-10-26T19:12:03Z",
        "updated": "2026-10-26T19:12:03Z",
        "first_seen": "2026-10-26T19:22:58Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "leia.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:cba0"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "josh.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:324b"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.203.160"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.50.75"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "josh.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-26T19:22:58Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.mrking19059.com",
                "mrking19059.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "57c54b45c412fb18bac346134185b96791c",
            "sha256": "105886b2e6cbb231d978d42d59fa38b77a719eb0cacca714d178ed4bbe848d94",
            "subject": "mrking19059.com",
            "valid_to": "2027-01-24T18:16:41Z",
            "valid_from": "2026-10-26T18:16:42Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-26T19:12:03Z",
            "updated": "2026-10-26T19:12:03Z",
            "expires": "2027-10-26T19:12:03Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "josh.ns.cloudflare.com",
                "leia.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-26T19:12:03Z",
                "registration": "2026-10-26T19:12:03Z",
                "registrar expiration": "2027-10-26T19:12:03Z",
                "last update of RDAP database": "2026-10-26T19:22:46Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T19:42:04Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mrking19059.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.33.126",
                    "host": "josh.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.184",
                    "host": "leia.ns.cloudflare.com"
                }
            ],
            "zone": "mrking19059.com"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "mrking19059.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "josh.ns.cloudflare.com",
                "leia.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"josh.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418527821, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-26T19:12:03Z",
            "updated": "2026-10-26T19:12:03Z",
            "expires": "2027-10-26T19:12:03Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "josh.ns.cloudflare.com",
                "leia.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-frame-options": "SAMEORIGIN",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```