# PhishDestroy domain threat record: mrpunter.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/mrpunter.com/ Machine-readable companion: https://phishdestroy.io/domain/mrpunter.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 02:01:19 UTC - Last availability or vendor check: 2026-10-23 10:27:56 UTC - Stored record updated: 2026-10-23 14:22:04 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ankr ## Stored infrastructure - Observed IP address: 185.207.198.29 - Registrar in stored WHOIS data: GoDaddy.com, LLC - Last stored HTTP status: 307 - Registration date (registry RDAP, mrpunter.com): 2018-01-06 11:37:13 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1667b-e6cb-73aa-abb8-61012640d534/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/mrpunter.com - Certificate Transparency search: https://crt.sh/?q=%25.mrpunter.com - Web Archive lookup: https://web.archive.org/web/*/https://mrpunter.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed mrpunter.com as a suspicious domain because VirusTotal reported one malicious and two suspicious detections out of 92 scanning engines. The domain was first seen by PhishDestroy on 2026-10-23 when an HTTP 307 response redirected to a Cloudflare‑protected page that returned a 403 status, preventing content retrieval. The recorded page title is “MrPunter”. How the scam works No specific malicious behavior was observed on the site; the classification is based on the presence of malicious or suspicious detections, which indicates the domain could be used for phishing, fraud or malware distribution. Without visible content the exact scheme cannot be determined. Evidence VirusTotal (2026-10-23) returned three detections: one malicious (Chong Lua Dao) and two suspicious (Gridinsoft, URLQuery) from 92 engines. Google Safe Browsing (2026-10-23) did not flag the domain. urlscan captured a 200 response for the /en/ path on 2026-10-23; its automated engine labeled the page malicious with a score of 75, while the overall verdict was clean. OTX listed four pulses mentioning the domain as of 2026-10-23. PhishDestroy’s internal blocklist includes the domain; external blocklists and Spamhaus showed no entries on the same date. Infrastructure The domain was registered with GoDaddy on 2018-01-06 and is served through Cloudflare, resolving to IP 185.207.198.29 owned by Nalmi Limited in the Netherlands. The TLS certificate, issued by Google Trust Services, is valid until 2026-12-03. Authoritative nameservers are kate.ns.cloudflare.com and toby.ns.cloudflare.com. What to do Visitors should not submit credentials or personal data; if any were entered, change passwords and review account activity. Defenders can block mrpunter.com at the network perimeter, monitor logs for requests to the recorded IP, and keep the domain on blocklists to prevent future access. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1667b-e6cb-73aa-abb8-61012640d534/ Cloudflare Radar report: https://radar.cloudflare.com/scan/cda2ba14-d75b-4c46-875d-2be458e0bba4 URLQuery report: https://urlquery.net/report/23efe515-6f81-4ba7-b59b-f16a0568564f Stored capture screenshot: https://urlscan.io/screenshots/01a1667b-e6cb-73aa-abb8-61012640d534.png Cloudflare Radar screenshot (2026-10-23T02:53:14Z): https://screenshots.phishdestroy.io/cf/cda2ba14-d75b-4c46-875d-2be458e0bba4.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/23efe515-6f81-4ba7-b59b-f16a0568564f.png URLScan screenshot (2026-10-02T06:35:52Z): https://screenshots.phishdestroy.io/us/01a0fb53-68d3-741c-9242-c70f2276741d.png URLScan capture report: https://urlscan.io/result/01a0fb53-68d3-741c-9242-c70f2276741d/ URLScan screenshot (2026-10-19T04:51:42Z): https://screenshots.phishdestroy.io/us/01a15280-3510-72f1-a133-96e154307657.png URLScan capture report: https://urlscan.io/result/01a15280-3510-72f1-a133-96e154307657/ VirusTotal report: https://www.virustotal.com/gui/domain/mrpunter.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mrpunter.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 03:00:11 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a1667b-e6cb-73aa-abb8-61012640d534.png Captured: 2026-10-23 02:01:19 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1667b-e6cb-73aa-abb8-61012640d534.png Captured: 2026-10-23 02:01:19 UTC Source report: https://urlscan.io/result/01a1667b-e6cb-73aa-abb8-61012640d534/ - URLScan capture 2: https://urlscan.io/screenshots/01a15280-3510-72f1-a133-96e154307657.png Captured: 2026-10-23 01:35:51 UTC Source report: https://urlscan.io/result/01a1667b-e6cb-73aa-abb8-61012640d534/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cda2ba14-d75b-4c46-875d-2be458e0bba4.png Captured: 2026-10-23 02:53:14 UTC Source report: https://radar.cloudflare.com/scan/cda2ba14-d75b-4c46-875d-2be458e0bba4 SHA-256: be9b334da9ecb9f5a35ae7e765af226fd2f27c14c50eef5671aee2b984dc5f54 - URLQuery: https://screenshots.phishdestroy.io/uq/23efe515-6f81-4ba7-b59b-f16a0568564f.png Source report: https://urlquery.net/report/23efe515-6f81-4ba7-b59b-f16a0568564f SHA-256: 27b0c8a7576b5844f23ca2cee9e54bda557e7c239948b7dbf3dbe07420ce783a - URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fb53-68d3-741c-9242-c70f2276741d.png Captured: 2026-10-02 06:35:52 UTC Source report: https://urlscan.io/result/01a0fb53-68d3-741c-9242-c70f2276741d/ SHA-256: cb1b89ef6fd124a0cb94411d668325baee81b79b10b9383839d2f2a794778af6 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15280-3510-72f1-a133-96e154307657.png Captured: 2026-10-19 04:51:42 UTC Source report: https://urlscan.io/result/01a15280-3510-72f1-a133-96e154307657/ SHA-256: cb1b89ef6fd124a0cb94411d668325baee81b79b10b9383839d2f2a794778af6 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T02:59:15Z", "uuid": "01a1667b-e6cb-73aa-abb8-61012640d534", "scanned_at": "2026-10-23T01:59:25Z", "final_url": "https://mrpunter.com/en/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://mrpunter.com/en/", "from": "https://mrpunter.com/", "status": 301 } ], "ip": "185.207.198.29", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "192.178.183.94", "2a00:1450:4001:c17::5f", "185.207.198.29" ], "asns": [ "15169", "213846" ], "countries": [ "US", "DE", "MH" ], "link_domains": [ "mrpunteraffiliates.com" ], "doc_hash": "5edecafd0471e0ea70e1a8721f10daf7789818aff1514aa1a0d6ea5170472d19", "script_hashes": [ "d47019e616e0bd62c33f6c008bbdcb3cc342e10e3022eb41725f427a7a2376ac" ], "cookies": [ "cf_clearance", "__cf_bm" ], "tls": { "san": [ "mrpunter.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "mrpunter.com", "protocol": "TLS 1.3", "valid_to": "2026-12-03T10:28:27Z", "valid_from": "2026-09-04T09:28:32Z" }, "domain_age_days": 3198, "apex_age_days": 3198, "tls_age_days": 48, "tls_valid_days": 90, "requests": 223, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 75, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html;charset=UTF-8", "strict-transport-security": "max-age=31536000; includeSubDomains\nmax-age=31536000" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T02:59:18Z", "uuid": "cda2ba14-d75b-4c46-875d-2be458e0bba4", "scanned_at": "2026-10-23T02:53:14Z", "final_url": "https://mrpunter.com/", "status": 403, "history": [ { "url": "https://mrpunter.com/", "status": 403 } ], "dom_hash": "6f49d43f283b5ca3a4d2237a97a883b7547ae08dc3f1437f1646e033fee5da09", "doc_hash": "58cb6aa606c4b7f1a3b73d6c990b541e64de5b6e9de317e0b6b6173cc2dd62d7", "domain_risks": [ "Content Servers", "Technology" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "mrpunter.com", "type": "A", "value": "185.207.198.29" } ], "dnssec_valid": false, "ip": "185.207.198.29", "whois": { "registrar": "GoDaddy.com, LLC", "created": "2018-01-06T11:37:13Z", "updated": "2026-09-07T09:02:33Z", "expires": "2028-01-06T11:37:13Z", "nameservers": [ "kate.ns.cloudflare.com", "toby.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T02:52:20Z", "analysis_at": "2026-10-23T02:42:27Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 2, "undetected": 34 }, "detections": { "URLQuery": "suspicious", "Gridinsoft": "suspicious", "Chong Lua Dao": "malicious" }, "reputation": 0, "popularity": { "Majestic": 449912 }, "registrar": "GoDaddy.com, LLC", "created": "2018-01-06T11:37:13Z", "expires": "2028-01-06T11:37:13Z", "updated": "2026-09-07T09:02:33Z", "first_seen": "2024-03-05T13:59:01Z", "dns": [ { "ttl": 300, "type": "MX", "value": "alt3.aspmx.l.google.com", "priority": 10 }, { "ttl": 300, "type": "MX", "value": "alt1.aspmx.l.google.com", "priority": 5 }, { "ttl": 300, "type": "MX", "value": "aspmx.l.google.com", "priority": 1 }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=T1XIkN1Vgs_mLFzw6O460BcChAckWfsuecrgy3gxJ0w" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "kate.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=1u8VW4Z4h6qWpPy69WAxX26nSXV_QNe5h_odPtimbEQ" }, { "ttl": 21600, "type": "NS", "value": "toby.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=w-m2-V0yCZOenTi1Oh-mO2imQ661fqBQPmuj0LrmMBY" }, { "ttl": 300, "type": "MX", "value": "alt4.aspmx.l.google.com", "priority": 10 }, { "ttl": 21600, "type": "NS", "value": "kate.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=CI9utAZr_zzkgyd_j3S2xjFxlxpVAKH8myT0gfZ2eik" }, { "ttl": 300, "type": "A", "value": "185.207.198.29" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:spf.mailjet.com include:_spf.google.com include:mail.zendesk.com include:carmamail.com ~all" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=pbkWl_HRvvOxDHARIoir4Qt7HpgpAqMmf-otrAENFVM" }, { "ttl": 300, "type": "MX", "value": "alt2.aspmx.l.google.com", "priority": 5 }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=me0Z_5X42nxUQIe56T9EbEjWTUm_WrLYRNRCKtwxjvE" } ], "dns_at": "2026-10-23T02:47:53Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "mrpunter.com" ], "issuer": "Google Trust Services / WE1", "serial": "d473cfbf61600a1c133e88b729c252b4", "sha256": "f4d6e4df9b6d2652ce5064de8453c33092d56a26c5d72f7e2ae4dbaede599085", "subject": "mrpunter.com", "valid_to": "2026-12-03T10:28:27Z", "valid_from": "2026-09-04T09:28:32Z" }, "whois": { "registrar": "GoDaddy.com, LLC", "registrar_iana_id": "146", "registrar_url": "http://www.godaddy.com", "created": "2018-01-06T11:37:13Z", "updated": "2026-09-07T09:02:33Z", "expires": "2028-01-06T11:37:13Z", "status": [ "clientDeleteProhibited", "clientRenewProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "kate.ns.cloudflare.com", "toby.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2028-01-06T11:37:13Z", "last changed": "2026-09-07T09:02:33Z", "registration": "2018-01-06T11:37:13Z", "last update of RDAP database": "2026-10-20T11:45:50Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T02:59:39Z", "mail_config": { "mx": [ "alt3.aspmx.l.google.com", "alt4.aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com", "aspmx.l.google.com" ], "spf": "v=spf1 include:spf.mailjet.com include:_spf.google.com include:mail.zendesk.com include:carmamail.com ~all", "dkim": [ "s1", "s2" ], "dmarc": true, "dkim_bits": 2048, "providers": [ "Google Workspace" ], "spf_lookups": 4 }, "caa_records": { "domain": "mrpunter.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-07T01:38:48Z", "first": "2008-06-05T23:31:59Z", "changes": 54, "days_archived": 62, "scans_per_day": 0.01, "avg_page_bytes": 2818 }, "robots_txt": { "present": true, "sitemaps": [ "https://mrpunter.com/sitemap.xml.gz" ] }, "sitemap": { "present": true, "url_count": 19 }, "social_tags": { "title": "MrPunter", "themeColor": "#292230" }, "trackers": { "requests": 183, "trackers": [ { "name": "Facebook", "company": "Meta", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Cookie Script", "company": "Cookie Script", "country": "LT", "category": "Consent Management", "requests": 1 }, { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Zendesk CDN", "company": "Zendesk", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Facebook Connect", "company": "Meta", "country": "US", "category": "Site Analytics", "requests": 1 }, { "name": "Hotjar", "company": "Hotjar", "country": "MT", "category": "Site Analytics", "requests": 1 }, { "name": "Google Tag Manager", "company": "Google", "country": "US", "category": "Utilities", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 307, "timings": { "dns": 3, "tls": 23, "wait": 32, "connect": 7, "download": 0 }, "response_ms": 65 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 26477, "co2_grams": 0.001, "cleaner_than": 51 }, "dns_server": { "ns": [ { "ip": "173.245.59.239", "host": "toby.ns.cloudflare.com" }, { "ip": "108.162.192.124", "host": "kate.ns.cloudflare.com" } ], "zone": "mrpunter.com" }, "cookies": { "cookies": [ { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "cf_clearance", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "CookieScriptConsent", "secure": true } ] }, "location": { "ip": "185.207.198.29", "asn": "213846", "org": "Nalmi Limited", "city": "Amsterdam", "country": "NL" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "mrpunter.com" }, "dns": { "A": [ "185.207.198.29" ], "MX": [ "{\"exchange\": \"alt1.aspmx.l.google.com\", \"priority\": 5}", "{\"exchange\": \"alt3.aspmx.l.google.com\", \"priority\": 10}", "{\"exchange\": \"alt4.aspmx.l.google.com\", \"priority\": 10}", "{\"exchange\": \"aspmx.l.google.com\", \"priority\": 1}", "{\"exchange\": \"alt2.aspmx.l.google.com\", \"priority\": 5}" ], "NS": [ "kate.ns.cloudflare.com", "toby.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"kate.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417615530, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=T1XIkN1Vgs_mLFzw6O460BcChAckWfsuecrgy3gxJ0w", "google-site-verification=w-m2-V0yCZOenTi1Oh-mO2imQ661fqBQPmuj0LrmMBY", "google-site-verification=pbkWl_HRvvOxDHARIoir4Qt7HpgpAqMmf-otrAENFVM", "google-site-verification=CI9utAZr_zzkgyd_j3S2xjFxlxpVAKH8myT0gfZ2eik", "google-site-verification=me0Z_5X42nxUQIe56T9EbEjWTUm_WrLYRNRCKtwxjvE", "google-site-verification=1u8VW4Z4h6qWpPy69WAxX26nSXV_QNe5h_odPtimbEQ", "v=spf1 include:spf.mailjet.com include:_spf.google.com include:mail.zendesk.com include:carmamail.com ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "185.207.198.29", "family": 4 }, "redirects": { "chain": [ "https://mrpunter.com", "https://mr54--mrpunter.com/" ], "count": 1 }, "rank": { "domain": "mrpunter.com" }, "whois": { "registrar": "GoDaddy.com, LLC", "created": "2018-01-06T11:37:13Z", "updated": "2026-09-07T09:02:33Z", "expires": "2028-01-06T11:37:13Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientRenewProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "kate.ns.cloudflare.com", "toby.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```