demo[.]test[.]m[.]rkingoods[.]com

PhishDestroy identifies demo.test.m.rkingoods.com as an active crypto drainer scam designed to steal cryptocurrency assets from unsuspecting users. This domain was flagged due to its deceptive registration details, infrastructure alignment with known drainer toolkits, and suspicious SSL certificate issuance. The domain leverages a subdomain structure (m.rkingoods.com) to mimic legitimate merchant domains while hosting malicious JavaScript payloads capable of draining wallet credentials and transferring funds without user consent. Analysis of its DNS propagation and WHOIS records reveals a recent creation date (June 26, 2021) paired with a high-risk hosting provider (AS44050, associated with bulletproof hosting services). Users interacting with this domain risk immediate financial loss, as the underlying scripts are engineered to intercept wallet connections and execute unauthorized transactions.

The domain’s infrastructure exhibits multiple red flags confirmed by independent threat intelligence platforms. According to VirusTotal, demo.test.m.rkingoods.com currently exhibits 1/95 detections across major antivirus engines, highlighting a critical blind spot in automated detection systems. The domain resolves to IP 185.149.120.183, a known malicious host with historical ties to cryptocurrency scams and malware distribution. Its SSL certificate, issued by Let’s Encrypt, provides a false sense of security despite the domain’s malicious intent—a common tactic to bypass browser warnings. The registrar, GoDaddy.com, LLC, shows no abnormal WHOIS protections, further complicating takedown efforts. Security researchers have observed this infrastructure hosting identical clone pages for multiple high-value targets, including NFT marketplaces and DeFi platforms, suggesting a coordinated campaign with reused malicious code.

If you visited demo.test.m.rkingoods.com, PhishDestroy advises immediate action to mitigate potential damage. Disconnect any cryptocurrency wallets from the internet, revoke any recently approved contract permissions, and initiate a transfer of remaining funds to a newly generated wallet. Scan your device for malware using tools like Malwarebytes or Windows Defender, as drainer scripts often include keyloggers or clipboard hijackers. Report the domain to your wallet provider and relevant fraud databases (e.g., Chainalysis Reactor, Etherscan Phishing DB) to aid in takedown efforts. Avoid interacting with similar subdomains under m.rkingoods.com, as they likely serve the same malicious purpose. For ongoing protection, enable hardware wallet signing for all transactions and use dedicated browsers (e.g., Brave with Metamask isolation) when accessing DeFi platforms.