# PhishDestroy domain threat record: xn--mrkng10059-0v3e.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/xn--mrkng10059-0v3e.com/
Machine-readable companion: https://phishdestroy.io/domain/xn--mrkng10059-0v3e.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 23:09:07 UTC
- Last availability or vendor check: 2026-10-25 23:03:18 UTC
- Stored record updated: 2026-10-25 23:25:22 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.212.54
- Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu
- Last stored HTTP status: 301
- Registration date (registry RDAP, xn--mrkng10059-0v3e.com): 2026-10-22 20:56:36 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a165e6-bcef-708c-8cb5-91e5cf627000/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/xn--mrkng10059-0v3e.com
- Certificate Transparency search: https://crt.sh/?q=%25.xn--mrkng10059-0v3e.com
- Web Archive lookup: https://web.archive.org/web/*/https://xn--mrkng10059-0v3e.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classifies xn--mrkng10059-0v3e.com as a fraudulent gambling site. The recorded page title advertises the domain as Turkey’s largest online casino platform. The domain was first seen by PhishDestroy on 2026-10-24 and was observed to perform a client‑side redirect to mrking100599.com, a confirmed phishing site. Spamhaus DBL listed the domain under the phishing category on the same date.

How the scam works
Fraudulent gambling sites lure visitors with promises of large payouts or exclusive games, then harvest login credentials, personal data, or payment information. Some operators use a redirector domain to forward traffic to a separate phishing site, obscuring the final destination and increasing the chance of credential capture. By presenting a legitimate‑sounding casino brand, the site attempts to gain user trust before the redirect occurs.

Evidence
VirusTotal scanned the domain on 2026-10-24 with 92 engines and reported zero detections. Google Safe Browsing checked the same date and did not flag the site. Spamhaus DBL listed the domain as phishing on 2026-10-24. OTX recorded two pulses referencing the domain on 2026-10-24. URLScan captured the site on 2026-10-23; its engine verdict marked the URL as malicious with a score of 99, while the overall verdict was non‑malicious. PhishDestroy’s intake log recorded the redirect to a known phishing domain as the reason for inclusion.

Infrastructure
The domain was registered on 2026-10-22 through Hosting Concepts B.V. d/b/a Registrar.eu, with a client‑transfer‑prohibited status. At the time of observation, DNS records pointed to Cloudflare IP addresses located in Canada, and the site was behind Cloudflare’s WAF. The TLS certificate, issued by Let’s Encrypt, covered the punycode domain and its sub‑domains and was valid until 2027-01-21. No additional hosting details were disclosed beyond the Cloudflare network.

What to do
Users should avoid interacting with the site and refrain from entering any credentials or payment information. If credentials were entered, change the associated passwords and monitor accounts for unauthorized activity. Defenders should block the domain and its redirect target at the network perimeter, update threat feeds with the Spamhaus and PhishDestroy listings, and review logs for any requests to the domain or its Cloudflare IPs.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a165e6-bcef-708c-8cb5-91e5cf627000/
Cloudflare Radar report: https://radar.cloudflare.com/scan/fe295b17-0bb8-4316-ae33-f0e1cce3715b
Stored capture screenshot: https://urlscan.io/screenshots/01a165e6-bcef-708c-8cb5-91e5cf627000.png
URLScan screenshot (2026-10-23T23:09:39Z): https://screenshots.phishdestroy.io/us/01a16b06-c734-7442-8465-3950505bbc8c.png
URLScan capture report: https://urlscan.io/result/01a16b06-c734-7442-8465-3950505bbc8c/
URLScan screenshot (2026-10-23T23:16:15Z): https://screenshots.phishdestroy.io/us/01a16b0c-d464-744b-837c-ae459716ec69.png
URLScan capture report: https://urlscan.io/result/01a16b0c-d464-744b-837c-ae459716ec69/
URLScan screenshot (2026-10-23T23:18:04Z): https://screenshots.phishdestroy.io/us/01a16b0e-2ba9-7697-ad3a-f3fa2060878e.png
URLScan capture report: https://urlscan.io/result/01a16b0e-2ba9-7697-ad3a-f3fa2060878e/
VirusTotal report: https://www.virustotal.com/gui/domain/xn--mrkng10059-0v3e.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xn--mrkng10059-0v3e.com
Archived copy: https://web.archive.org/web/20261023231022/https://xn--mrkng10059-0v3e.com/tr/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 05:29:03 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a165e6-bcef-708c-8cb5-91e5cf627000.png
  Captured: 2026-10-23 23:09:07 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a165e6-bcef-708c-8cb5-91e5cf627000.png
  Captured: 2026-10-24 19:23:09 UTC
  Source report: https://urlscan.io/result/01a165e6-bcef-708c-8cb5-91e5cf627000/
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16b06-c734-7442-8465-3950505bbc8c.png
  Captured: 2026-10-23 23:09:39 UTC
  Source report: https://urlscan.io/result/01a16b06-c734-7442-8465-3950505bbc8c/
  SHA-256: 635b2ab3b3f1890787720616fa3b92d0c1d4bbdea5abd7efce762b6ae3ebb055
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16b0c-d464-744b-837c-ae459716ec69.png
  Captured: 2026-10-23 23:16:15 UTC
  Source report: https://urlscan.io/result/01a16b0c-d464-744b-837c-ae459716ec69/
  SHA-256: 635b2ab3b3f1890787720616fa3b92d0c1d4bbdea5abd7efce762b6ae3ebb055
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16b0e-2ba9-7697-ad3a-f3fa2060878e.png
  Captured: 2026-10-23 23:18:04 UTC
  Source report: https://urlscan.io/result/01a16b0e-2ba9-7697-ad3a-f3fa2060878e/
  SHA-256: d5b7fdb7970cae261dba0bcc7fb4d4abf8e4f9ef2d1219d922928716aac4fed0

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T23:12:20Z",
        "uuid": "01a165e6-bcef-708c-8cb5-91e5cf627000",
        "scanned_at": "2026-10-22T23:16:31Z",
        "final_url": "https://xn--mrkng10059-0v3e.com/tr/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://xn--mrkng10059-0v3e.com/",
                "from": "http://xn--mrkng10059-0v3e.com/",
                "status": 307
            },
            {
                "to": "https://xn--mrkng10059-0v3e.com/tr/",
                "from": "https://xn--mrkng10059-0v3e.com/",
                "status": 301
            }
        ],
        "ip": "172.67.205.46",
        "domains": [
            "widget-v3.smartsuppcdn.com",
            "cdn.jsdelivr.net",
            "websocket-visitors.smartsupp.com",
            "bootstrap.smartsuppchat.com",
            "www.smartsuppchat.com",
            "code.jquery.com"
        ],
        "ips": [
            "195.181.175.40",
            "63.185.191.188",
            "195.181.175.41",
            "151.101.193.155",
            "151.101.193.229",
            "172.67.205.46"
        ],
        "asns": [
            "60068",
            "16509",
            "54113",
            "13335"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "b9baf637e5034895a7a91647a4707e7bd68a60e5ceafde0cd8fbfa25057a2c09",
        "globals": [
            "$",
            "jQuery",
            "Swiper",
            "_smartsupp",
            "smartsupp",
            "SMARTSUPP_LOADED",
            "$smartsupp"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "storage_keys": [
            "ssupp_32c212dafbf9509f5356335317eed617a571693a"
        ],
        "tls": {
            "san": [
                "*.xn--mrkng10059-0v3e.com",
                "xn--mrkng10059-0v3e.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "xn--mrkng10059-0v3e.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-20T21:33:43Z",
            "valid_from": "2026-10-22T21:33:44Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 74,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T23:12:22Z",
        "uuid": "fe295b17-0bb8-4316-ae33-f0e1cce3715b",
        "scanned_at": "2026-10-23T23:11:58Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T05:22:11Z",
        "analysis_at": "2026-10-24T04:49:46Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "tags": [
            "dga",
            "non-ascii"
        ],
        "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
        "created": "2026-10-22T20:56:36Z",
        "expires": "2027-10-22T20:56:36Z",
        "updated": "2026-10-22T22:56:39Z",
        "first_seen": "2026-10-22T21:09:17Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:d436"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.212.54"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nataly.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:356c"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "javier.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.53.108"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "javier.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-24T04:51:15Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.xn--mrkng10059-0v3e.com",
                "xn--mrkng10059-0v3e.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6600918c41fdab0ecb38f1ec479c99ea05",
            "sha256": "1ed6b84519b7265baece8f31ef600597a5eb3efb8363f2a4ba5990b9e827a176",
            "subject": "xn--mrkng10059-0v3e.com",
            "valid_to": "2027-01-21T16:18:04Z",
            "valid_from": "2026-10-23T16:18:05Z"
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "http://www.openprovider.com",
            "created": "2026-10-22T20:56:36Z",
            "updated": "2026-10-22T20:56:39Z",
            "expires": "2027-10-22T20:56:36Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "dahlia.ns.cloudflare.com",
                "yichun.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-22T20:56:36Z",
                "registration": "2026-10-22T20:56:36Z",
                "registrar expiration": "2027-10-22T20:56:36Z",
                "last update of RDAP database": "2026-10-22T21:09:28Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T23:13:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "xn--mrkng10059-0v3e.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T23:10:22Z",
            "first": "2026-10-23T23:10:22Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1554
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://xn--mrkng10059-0v3e.com/sitemap.xml"
            ]
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.33",
                    "host": "chance.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.160",
                    "host": "gwen.ns.cloudflare.com"
                }
            ],
            "zone": "xn--mrkng10059-0v3e.com"
        },
        "location": {
            "ip": "2606:4700:3031::6815:356c",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "xn--mrkng10059-0v3e.com"
        },
        "dns": {
            "A": [
                "172.67.212.54",
                "104.21.53.108"
            ],
            "NS": [
                "gwen.ns.cloudflare.com",
                "chance.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"chance.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418249622, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3033::ac43:d436",
                "2606:4700:3031::6815:356c"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3031::6815:356c",
            "family": 6
        },
        "subdomains": {
            "count": 10,
            "subdomains": [
                "autoconfig.xn--mrkng10059-0v3e.com",
                "autodiscover.xn--mrkng10059-0v3e.com",
                "cpanel.xn--mrkng10059-0v3e.com",
                "cpcalendars.xn--mrkng10059-0v3e.com",
                "cpcontacts.xn--mrkng10059-0v3e.com",
                "mail.xn--mrkng10059-0v3e.com",
                "webdisk.xn--mrkng10059-0v3e.com",
                "webmail.xn--mrkng10059-0v3e.com",
                "whm.xn--mrkng10059-0v3e.com",
                "www.xn--mrkng10059-0v3e.com"
            ]
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2026-10-22T20:56:36Z",
            "updated": "2026-10-23T17:11:58Z",
            "expires": "2027-10-22T20:56:36Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "javier.ns.cloudflare.com",
                "nataly.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-frame-options": "SAMEORIGIN",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```