# PhishDestroy domain threat record: xn--mrkng10059-m8a.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/xn--mrkng10059-m8a.com/ Machine-readable companion: https://phishdestroy.io/domain/xn--mrkng10059-m8a.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 13:44:15 UTC - Last availability or vendor check: 2026-10-25 13:44:15 UTC - Stored record updated: 2026-10-25 15:30:34 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: counter-strike ## Stored infrastructure - Observed IP address: 88.222.222.94 - Registrar in stored WHOIS data: Dynadot Inc ## Evidence links - URLScan report: https://urlscan.io/result/01a1734c-2b37-755b-a5e8-7baf169a5fdf/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/xn--mrkng10059-m8a.com - Certificate Transparency search: https://crt.sh/?q=%25.xn--mrkng10059-m8a.com - Web Archive lookup: https://web.archive.org/web/*/https://xn--mrkng10059-m8a.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added xn--mrkng10059-m8a.com to its blocklist on 2026-10-25. The intake system flagged the domain because it was registered on the same day it was first seen, a pattern often associated with abuse. The page fetched on that date returned HTTP 200 and showed a casino/slot‑style site, but the automated assessment found no clear impersonation or malicious functionality. How the scam works A newly‑registered site that offers gambling content can be used to lure users into depositing money, installing unwanted software, or providing login credentials, although no such activity was observed on this page. Because no specific malicious mechanism was detected, the listing reflects a precautionary suspicion rather than confirmed fraud. Evidence VirusTotal scanned the domain on 2026-10-25 and reported 0 detections out of 92 engines. Google Safe Browsing checked the same day and did not flag the site. URLScan captured the page on 2026-10-25; its machine‑learning engine labeled it malicious with a score of 100, while the overall verdict was non‑malicious. PhishDestroy’s internal blocklist marks the domain as listed, and external blocklists returned no hits. OTX recorded four pulses mentioning the domain as of 2026-10-25. Infrastructure The domain was registered with Dynadot Inc on 2026-10-25 and carries a clientTransferProhibited status. TLS was provided by Let’s Encrypt, valid from 2026-10-25 to 2027-01-23, and the certificate includes the SANs xn--mrkng10059-m8a.com and www.xn--mrkng10059-m8a.com. The DNS records captured on 2026-10-25 listed IPv4 addresses 88.223.87.153 and 147.79.79.58, and IPv6 addresses in the 2a02:4780:: range; the hosting information observed pointed to Hostinger International Limited. What to do Treat the site as suspicious and avoid entering personal, financial, or login information. If any credentials were submitted, change them immediately and monitor associated accounts for unauthorized activity. Defenders should add the exact domain to blocklists and review logs for connections to the recorded IP addresses. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1734c-2b37-755b-a5e8-7baf169a5fdf/ Cloudflare Radar report: https://radar.cloudflare.com/scan/a519b6f9-5109-4f7e-be34-284841435979 URLQuery report: https://urlquery.net/report/b93ce9d4-474f-4d86-a897-6bbb38f4606a Stored capture screenshot: https://urlscan.io/screenshots/01a1734c-2b37-755b-a5e8-7baf169a5fdf.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/b93ce9d4-474f-4d86-a897-6bbb38f4606a.png URLScan screenshot (2026-10-25T13:40:03Z): https://screenshots.phishdestroy.io/us/01a17348-a46b-7629-8c84-489944158725.png URLScan capture report: https://urlscan.io/result/01a17348-a46b-7629-8c84-489944158725/ URLScan screenshot (2026-10-25T13:45:22Z): https://screenshots.phishdestroy.io/us/01a1734e-bdf4-7429-ae22-f002941e5440.png URLScan capture report: https://urlscan.io/result/01a1734e-bdf4-7429-ae22-f002941e5440/ VirusTotal report: https://www.virustotal.com/gui/domain/xn--mrkng10059-m8a.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xn--mrkng10059-m8a.com Archived copy: https://web.archive.org/web/20261025134627/https://xn--mrkng10059-m8a.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 14:18:04 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a1734c-2b37-755b-a5e8-7baf169a5fdf.png Captured: 2026-10-25 13:44:15 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1734c-2b37-755b-a5e8-7baf169a5fdf.png Captured: 2026-10-25 13:44:15 UTC Source report: https://urlscan.io/result/01a1734c-2b37-755b-a5e8-7baf169a5fdf/ - URLQuery: https://screenshots.phishdestroy.io/uq/b93ce9d4-474f-4d86-a897-6bbb38f4606a.png Source report: https://urlquery.net/report/b93ce9d4-474f-4d86-a897-6bbb38f4606a SHA-256: 49db14a93a7f148479494cee446571734210fe4087a85c0cd5d5cae3de0a6d9e - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17348-a46b-7629-8c84-489944158725.png Captured: 2026-10-25 13:40:03 UTC Source report: https://urlscan.io/result/01a17348-a46b-7629-8c84-489944158725/ SHA-256: 588ff654cd60835566bb17809bafed73be0879d4f8f290441fcbddd2a10fee8e - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a1734e-bdf4-7429-ae22-f002941e5440.png Captured: 2026-10-25 13:45:22 UTC Source report: https://urlscan.io/result/01a1734e-bdf4-7429-ae22-f002941e5440/ SHA-256: b905769e07fbed42ba7b817c8ada268cdb742687f71c273cae8534763e7df386 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T13:57:52Z", "uuid": "01a1734c-2b37-755b-a5e8-7baf169a5fdf", "scanned_at": "2026-10-25T13:42:28Z", "final_url": "https://xn--mrkng10059-m8a.com/", "status": 200, "ip": "88.223.87.153", "ptr": "88-223-87-153.init.lt", "domains": [ "cms.fjykjczttspydxcx.com", "cms.deimosphobos.net", "statistics.bcapps.org", "cmsbetconstruct.com", "getbootstrap.com", "cdnjs.cloudflare.com", "embed.tawk.to", "code.jquery.com", "cdn.jsdelivr.net", "ca-ft.kgrrtqnnksnjhfuc.com" ], "ips": [ "185.162.228.4", "172.66.161.212", "185.162.230.7", "185.162.229.3", "104.20.26.6", "104.17.24.14", "151.101.65.155", "104.17.208.5", "88.223.87.153" ], "asns": [ "209242", "13335", "54113", "47583" ], "countries": [ "IM", "US" ], "link_domains": [ "v2.zopim.com", "shrt.vip", "www.nispartner.com", "policies.google.com", "exchange.fulgurpay.com", "ultrabettv197.com", "ultrabet.tv", "android.nonamens.com", "betnis.app" ], "doc_hash": "ea3815502c9c183dd180dac273480848877515c4423bd6ea820b5bb55d479a4d", "script_hashes": [ "bc424afb4e00bfa30f2ac575084b2e6ee59e2f5853f98237e6107a46ffb88b9c", "bfd5ca2e0dd9aedd3ab6c5fa5772c022bfa62bbf45e82e8ae69ef15f9e3f5f81", "dbd0966603737afe9393c0c1405a170a0089dec498277df3d1859a4a955a434e", "40c8294c029297a14b2b01de3bf08ea6614f543849b25da2ed2bbf7eea1c9141", "0ea815d0b0dd6600d9b958c8b37d772eff3af3b51e4853b0bed1ecdb62d15813", "60c31c50f991faea6bd832419082c5b94214a7dcfd8e369e0d8dbaa4e8e6ea23", "741b8f4f89318f130604081c3a71ea85518e23d7d0244350c7e9488d0eefa6ec", "0c320da35fd87eaee81fd5a73d4cddbf533541ed9004cf5a9ca19adeacbf4f47", "2b2ad4097763036b972f241afc0a6df01ad886382e49fb532c914554de096057", "fa00f5dd4af6744a2c5a3045caaef2de54d2b0377646dfff1e7bc4bf0a931ed7" ], "globals": [ "webpackJsonpreactive-sportsbook", "$", "jQuery", "Tawk_API", "Tawk_LoadStart", "Sweetalert2", "SweetAlert", "Swal", "sweetAlert", "swal", "openmodal", "closemodal", "loginorpay", "loginoralert", "logIn", "logOut", "signUp", "casino", "canlidestek", "canlicasino", "yukleoyun", "CustomAlert", "Popper", "bootstrap", "Holder", "mini_menu", "hakkimizda", "yardim", "kurallar", "promosyonlar", "mobil_uygulamalar", "programlar", "sayfa_finanssal_islemler_ac", "sayfa_finanssal_islemler_kapat", "sayfa_gizlilik_ilkesi_ac", "sayfa_gizlilik_ilkesi_kapat", "sayfa_sorumlu_bahis_ac", "sayfa_sorumlu_bahis_kapat", "sayfa_iletisim_ac", "sayfa_iletisim_kapat" ], "cookies": [ "PHPSESSID", "__cf_bm" ], "tls": { "san": [ "www.xn--mrkng10059-m8a.com", "xn--mrkng10059-m8a.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "xn--mrkng10059-m8a.com", "protocol": "TLS 1.3", "valid_to": "2027-01-23T12:16:12Z", "valid_from": "2026-10-25T12:16:13Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 140, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "hcdn", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/7.3.33", "content-security-policy": "upgrade-insecure-requests" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T14:17:16Z", "uuid": "a519b6f9-5109-4f7e-be34-284841435979", "scanned_at": "2026-10-25T14:16:34Z" }, "vt": { "v": 1, "fetched_at": "2026-10-25T14:15:51Z", "analysis_at": "2026-10-25T13:57:25Z", "stats": { "timeout": 0, "harmless": 0, "malicious": 0, "suspicious": 0, "undetected": 92 }, "reputation": 0, "tags": [ "dga", "non-ascii" ], "registrar": "Dynadot Inc", "created": "2026-10-25T13:00:44Z", "expires": "2027-10-25T13:00:44Z", "updated": "2026-10-25T13:02:06Z", "first_seen": "2026-10-25T13:04:41Z", "dns": [ { "ttl": 60, "type": "A", "value": "88.223.87.64" }, { "ttl": 14400, "type": "MX", "value": "mx1.hostinger.com", "priority": 5 }, { "ttl": 60, "type": "AAAA", "value": "2a02:4780:4d:8a7e:3d6a:dfa5:e752:379b" }, { "ttl": 18096, "type": "NS", "value": "apollo.dns-parking.com" }, { "ttl": 14400, "type": "MX", "value": "mx2.hostinger.com", "priority": 10 }, { "ttl": 60, "type": "AAAA", "value": "2a02:4780:4b:91b1:248d:9258:e077:28a4" }, { "ttl": 18096, "type": "NS", "value": "athena.dns-parking.com" }, { "ttl": 3600, "type": "SOA", "rname": "dns.hostinger.com", "value": "athena.dns-parking.com" }, { "ttl": 2097, "type": "TXT", "value": "v=spf1 include:_spf.mail.hostinger.com ~all" }, { "ttl": 60, "type": "A", "value": "147.79.79.58" } ], "dns_at": "2026-10-25T14:03:03Z", "jarm": "27d40d40d00040d00042d43d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "www.xn--mrkng10059-m8a.com", "xn--mrkng10059-m8a.com" ], "issuer": "Let's Encrypt / YE2", "serial": "51c82e061ddd360b924fdb66ed8a7251742", "sha256": "0380aa0b61c6b7d5c2f2c64f9b4f3145ac451bdcdb5673b7c4c6e3150652e5ca", "subject": "xn--mrkng10059-m8a.com", "valid_to": "2027-01-23T12:16:12Z", "valid_from": "2026-10-25T12:16:13Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-10-25T13:00:44Z", "updated": "2026-10-25T13:02:06Z", "expires": "2027-10-25T13:00:44Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "apollo.dns-parking.com", "athena.dns-parking.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-10-25T13:00:44Z", "last changed": "2026-10-25T13:02:06Z", "registration": "2026-10-25T13:00:44Z", "last update of RDAP database": "2026-10-25T13:04:28Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T14:17:38Z", "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T13:46:27Z", "first": "2026-10-25T13:46:27Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 254280 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "dns_server": { "ns": [ { "ip": "172.64.52.164", "host": "athena.dns-parking.com" }, { "ip": "172.64.53.7", "host": "apollo.dns-parking.com" } ], "zone": "xn--mrkng10059-m8a.com" }, "location": { "ip": "2a02:4780:44:b64:ff96:69d7:740a:51b9", "asn": "47583", "org": "Hostinger International Limited", "city": "Frankfurt am Main", "country": "DE" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "xn--mrkng10059-m8a.com" }, "dns": { "A": [ "92.113.16.248", "92.113.23.193" ], "MX": [ "{\"exchange\": \"mx1.hostinger.com\", \"priority\": 5}", "{\"exchange\": \"mx2.hostinger.com\", \"priority\": 10}" ], "NS": [ "apollo.dns-parking.com", "athena.dns-parking.com" ], "TXT": [ "v=spf1 include:_spf.mail.hostinger.com ~all" ], "AAAA": [ "2a02:4780:42:5082:6c37:6ee0:66b7:cfb2", "2a02:4780:45:bd73:3548:c5b6:8468:b4c1" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2a02:4780:42:5082:6c37:6ee0:66b7:cfb2", "family": 6 }, "subdomains": { "count": 1, "subdomains": [ "www.xn--mrkng10059-m8a.com" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-10-25T13:00:44Z", "updated": "2026-10-25T13:02:06Z", "expires": "2027-10-25T13:00:44Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "apollo.dns-parking.com", "athena.dns-parking.com" ] }, "headers": { "headers": { "server": "hcdn", "content-type": "text/html" } } } } ```