mrking5023[.]co

Analysis date: July 29, 2026. The domain www.mrking5023.co was registered through Dynadot Inc on July 28, 2026 and is currently resolving to the IPv4 address 181.174.166.152. Authoritative name servers are ariadne.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy feed, which is consistent with its classification as a generic phishing infrastructure. VirusTotal reports that the domain has been scanned by 91 AV engines; none of the engines have raised a detection at the time of the scan.

The absence of detections does not constitute a clearance, and the domain remains active. No additional telemetry such as SSL certificate details, HTTP response codes, or page title has been released, so the precise content served by the site cannot be verified. Consequently, the exact phishing lure, target brand, or credential‑collection mechanism remains unknown. The short lifespan—creation only one day prior to the first observation—suggests a fast‑flux or opportunistic campaign that may be used for one‑off attacks before takedown.

Defenders should continue to monitor DNS queries for the domain and its associated IP address, enforce outbound filtering for connections to 181.174.166.152, and add the domain to internal block lists. Email security gateways should be updated to flag any messages containing URLs that resolve to the domain. Because the infrastructure relies on Cloudflare’s DNS, any future sub‑domains or variations may appear under the same name servers, so broader monitoring of the authoritative NS records is advisable. Until further forensic analysis of the web content is available, the domain should be treated as malicious and blocked at the network perimeter.