m[.]mrtking-guncel13[.]net

Analysis of the sub‑domain m.mrtking-guncel13.net shows it is currently active and associated with a generic phishing threat. The domain resolves to the Cloudflare IP address 188.114.96.3, which places the infrastructure in Canada and masks the true hosting location. DNS is delegated to harlan.ns.cloudflare.com and olga.ns.cloudflare.com, both Cloudflare‑controlled name servers, confirming the use of a CDN for anonymity. An HTTP 301 redirect is observed, and the page title returned by the server is "mrtking-guncel13.net | 520: Web server is returning an unknown error," indicating the site presently serves a Cloudflare 520 error page rather than a visible landing page. The TLS certificate is issued by Google Trust Services under the WE1 certificate authority, a standard certificate that does not provide additional risk cues. VirusTotal reports that six of ninety‑one security vendors have flagged the domain, suggesting that a minority of scanners have identified malicious characteristics. The domain appears on at least one external blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment of phishing activity. Registration was performed through Dynadot Inc, a registrar that does not inherently imply legitimacy or maliciousness. Because the actual content of the site has not been captured, the specific phishing lure, target brand, or credential‑harvesting mechanism remains unknown. Defenders should treat the domain as hostile: block the domain and its associated sub‑domains at network perimeter, add the IP address 188.114.96.3 to deny‑list rules, monitor DNS queries for related Cloudflare name servers, and ensure threat‑intel feeds are updated with the current blocklist entry. Further investigation, such as sandbox retrieval of the landing page if it becomes reachable, is recommended to clarify the payload and victim profile.