# PhishDestroy domain threat record: mgmarket-5.at

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mgmarket-5.at/
Machine-readable companion: https://phishdestroy.io/domain/mgmarket-5.at/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-07 12:45:05 UTC
- Last availability or vendor check: 2026-10-22 10:37:40 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 104.21.72.99
- Registrar in stored WHOIS data: Docky /Huang Chao Ming ( https://nic.at/registrar/723 )
- Last stored HTTP status: 302

## Evidence links

- URLScan report: https://urlscan.io/result/01a11676-163c-72eb-a5d3-0167247b0f57/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mgmarket-5.at
- Certificate Transparency search: https://crt.sh/?q=%25.mgmarket-5.at
- Web Archive lookup: https://web.archive.org/web/*/https://mgmarket-5.at/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
mgmarket-5.at presents itself under the title "MEGAWEB (M3GA)" and is built to pass as an access point to that platform. The numbered, mirror-style domain name targets people looking for a working entry address, who often cannot easily confirm which one is genuine. PhishDestroy first flagged the domain on 2026-10-07. On 2026-10-19 it was still online and serving a redirect.

How the scam works
Lookalike mirrors of the MEGA brand typically copy its login and account screens so visitors type in their real usernames, passwords and sometimes one-time codes. Those credentials let the operators take over the genuine account and drain any balance held there. Some clones go further and display a fake deposit address, so any cryptocurrency sent "to top up" goes straight to the scammers and cannot be recovered. The redirect seen on 2026-10-19 lets the operators send visitors to a different landing page at any time without changing the domain they share.

Evidence
Four of 92 VirusTotal engines flag the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet and SOCRadar. That is a low count, so many security products will still let it load, but these vendors reached their verdicts independently. Spamhaus lists the domain on its DBL as spam. Four AlienVault OTX threat pulses reference it, which means other researchers are tracking it. PhishDestroy carries it on its blocklist.

Infrastructure
The domain uses Austria's .at zone and is registered through Docky / Huang Chao Ming. It sits behind Cloudflare, which places its address on a Cloudflare network geolocated to Canada and hides the real origin server. The Google Trust Services WE1 certificate is the standard one issued for Cloudflare-fronted sites. The padlock it produces says nothing about whether the site is legitimate.

What to do
If you logged in on mgmarket-5.at, change that password right away on the real service and on any other site where you reused it, then reset or re-enroll your two-factor authentication. Move any remaining balance out of the affected account. Treat any deposit address the page showed you as belonging to the scammers and never send funds to it. Defenders should block the domain at DNS and proxy level, hunt for other numbered "mgmarket" variants, and report it to the .at registry and to Cloudflare's abuse team.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11676-163c-72eb-a5d3-0167247b0f57/
VirusTotal report: https://www.virustotal.com/gui/domain/mgmarket-5.at
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mgmarket-5.at
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:30:01 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a11676-163c-72eb-a5d3-0167247b0f57.png
  Captured: 2026-10-07 13:05:22 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a11664-7456-742f-bb54-0813c8de515e.png
  Captured: 2026-10-07 12:45:05 UTC
  Source report: https://urlscan.io/result/01a11664-7456-742f-bb54-0813c8de515e/