mgcth[.]top

mgcth.top was observed by multiple security services and is currently flagged as a brand‑impersonation site targeting x.com. The domain was registered on 28 November 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 188.114.96.3, which is associated with AS13335 in the United States. DNS resolution uses the Cloudflare authoritative nameservers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page title, indicating that the web server is running without a custom front‑end. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist.

VirusTotal reports that six of ninety‑five scanned vendors flagged the domain, confirming that a subset of scanners consider it malicious. PhishDestroy has already taken the site offline, and the current status is reported as offline. The available evidence confirms the intent to impersonate the brand x.com, but the specific payload, credential‑harvesting forms, or redirect behavior have not been captured. Absence of an SSL certificate and the generic nginx title suggest that the site may have been a placeholder or a rapidly deployed phishing front‑end that was shut down before further analysis could be performed.

The lack of additional public reports or sandbox observations leaves the exact phishing kit unknown. Defenders should continue to block the IP address 188.114.96.3 and the domain mgcth.top at DNS and proxy layers, add the domain to internal blocklists, and monitor for any re‑registration or use of similar Cloudflare‑hosted IP ranges. Because the registrar information is public, future registrations from NiceNIC International Group Co., Limited should be scrutinised. Continuous feed updates from VirusTotal, PhishDestroy, and other threat‑intel sources are recommended to capture any re‑appearance of the domain or related infrastructure.