# PhishDestroy domain threat record: mgmarket-6.at Content language: English Canonical HTML report: https://phishdestroy.io/domain/mgmarket-6.at/ Machine-readable companion: https://phishdestroy.io/domain/mgmarket-6.at/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-07 12:23:10 UTC - Last availability or vendor check: 2026-10-22 10:37:40 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: telegram ## Stored infrastructure - Observed IP address: 104.21.61.49 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 302 ## Evidence links - URLScan report: https://urlscan.io/result/01a11650-3267-73eb-938b-8e54ea345472/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/mgmarket-6.at - Certificate Transparency search: https://crt.sh/?q=%25.mgmarket-6.at - Web Archive lookup: https://web.archive.org/web/*/https://mgmarket-6.at/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview mgmarket-6.at presents itself under the page title "MEGAWEB (M3GA)" and impersonates the MEGA marketplace brand. Its numbered domain is built to look like one of the rotating mirror addresses users hunt for. It targets people searching for a working entrance to that platform. PhishDestroy first saw it on 2026-10-07, and on 2026-10-19 it was still online and serving a redirect. How the scam works Lookalike mirror sites copy a marketplace's branding and login screen so visitors believe they have reached the real service. Anything typed into the fake login, including username, password and sometimes a 2FA or PGP-related code, goes to the operators. They can then take over the genuine account and empty its balance. Some clones also show a deposit address controlled by the scammers, so any crypto sent to "top up" the account is gone. The redirect means visitors may be passed on to another page in the same chain rather than landing on a static clone. Evidence Detection is thin so far. VirusTotal shows 3 of 92 engines flagging the domain (CRDF, Forcepoint ThreatSeeker and SOCRadar) as of 2026-10-19, so most security tools will not warn a visitor. Four AlienVault OTX threat pulses reference it, which means other researchers have tied it to malicious activity. Among blocklists, it currently appears only on PhishDestroy's. Infrastructure The site sits behind Cloudflare's network (CLOUDFLARENET, United States). That hides the real origin server and lets operators swap backends without changing the visible address. Its certificate comes from Google Trust Services (WE1), so the padlock in the browser says nothing about whether the site is legitimate. The "-6" suffix is typical of mirror-style naming, where new numbered variants appear as old ones are blocked. What to do If you logged in through this domain, change your password on the real service from a trusted address right away. Reset 2FA or any security codes you entered, and check for unfamiliar sessions or withdrawals. If you sent crypto to a deposit address shown here, treat it as lost and do not pay any "fee" or "verification" charge someone offers to recover it. Only reach mirror addresses through sources you have verified before, never through search results or chat links. Defenders should block the domain and watch for sibling numbered variants of the same name. Reports to Cloudflare and to the vendors who have not yet flagged it will help speed up takedown. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a11650-3267-73eb-938b-8e54ea345472/ VirusTotal report: https://www.virustotal.com/gui/domain/mgmarket-6.at Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mgmarket-6.at Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:30:04 UTC ## Stored page captures - Primary capture: https://i.ibb.co/k6MZL3d9/1c4603b4a825.png Captured: 2026-10-07 12:23:10 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a11650-3267-73eb-938b-8e54ea345472.png Captured: 2026-10-07 12:23:10 UTC Source report: https://urlscan.io/result/01a11650-3267-73eb-938b-8e54ea345472/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/486eada6-b0ba-4b2c-85d7-ab47613a28d0.png Captured: 2026-10-07 12:25:22 UTC Source report: https://radar.cloudflare.com/scan/486eada6-b0ba-4b2c-85d7-ab47613a28d0 SHA-256: 45e61cd5ab99db6c6f0da113c2f8850bd53c805062a20c109eb36396555c4067 - URLScan ยท 2026-10-07: https://screenshots.phishdestroy.io/us/01a11655-dffc-7519-827a-04eb4f514e0c.png Captured: 2026-10-07 12:28:15 UTC Source report: https://urlscan.io/result/01a11655-dffc-7519-827a-04eb4f514e0c/ SHA-256: 63e6cec72ba3992764f49630a0e050dc68263c8988b5d93747aa26bccc7038ad ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T19:26:39Z", "uuid": "01a11650-3267-73eb-938b-8e54ea345472", "scanned_at": "2026-10-07T12:22:14Z", "final_url": "https://mgmarket-6.at/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://mgmarket-6.at/", "from": "http://mgmarket-6.at/", "status": 307 } ], "ip": "104.21.61.49", "domains": [ "cdn.jsdelivr.net", "static.cloudflareinsights.com" ], "ips": [ "104.16.79.73", "104.17.208.5", "104.21.61.49" ], "asns": [ "13335" ], "link_domains": [ "mq2.at", "mega-web.at", "mega555gfjk7v3gsfhgbnjlhbxro37prv6jbq4dbmm5ewbberh6vsoid.onion", "m3ga.mg", "mega-web.com", "www.youtube.com", "t.me" ], "social": [ "https://www.youtube.com/@moriartymega", "https://t.me/mg_moriarti_bot" ], "doc_hash": "d443ba5c3e52fa1160c747f5d793bff3c65d199b8d500cc8c5b18e1338ed9d42", "globals": [ "Carousel", "Fancybox", "Panzoom", "toggleFixedClass", "__cfBeacon", "projectsTags", "triggerPoint", "projectsHeaders" ], "cookies": [ "PHPSESSID" ], "tls": { "san": [ "mgmarket-6.at", "*.mgmarket-6.at" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "mgmarket-6.at", "protocol": "QUIC", "valid_to": "2026-11-09T14:05:54Z", "valid_from": "2026-08-11T13:07:20Z" }, "domain_age_days": 339, "apex_age_days": 339, "tls_age_days": 56, "tls_valid_days": 90, "requests": 14, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 64, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T19:36:52Z", "uuid": "486eada6-b0ba-4b2c-85d7-ab47613a28d0", "scanned_at": "2026-10-07T12:25:22Z", "final_url": "https://mgmarket-6.at/captcha/185804/index", "status": 200, "redirected": "same-domain", "history": [ { "url": "https://mgmarket-6.at/", "status": 302 }, { "url": "https://mgmarket-6.at/captcha/185804/index", "status": 200 } ], "dom_hash": "dd9b3ac611c18471c2cff6dd3e2166f69debe133585713dce35a5ea168f12e03", "doc_hash": "17886127d5bd1d6255785e1a3a54e1112620983ad7fa4da5374f0edbac4ef4b3", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "mgmarket-6.at", "type": "A", "value": "172.67.206.122" }, { "name": "mgmarket-6.at", "type": "A", "value": "104.21.61.49" }, { "name": "mgmarket-6.at", "type": "AAAA", "value": "2606:4700:3037::ac43:ce7a" }, { "name": "mgmarket-6.at", "type": "AAAA", "value": "2606:4700:3036::6815:3d31" } ], "dnssec_valid": false, "ip": "172.67.206.122", "whois": { "created": "2026-08-11T15:00:50Z", "updated": "2026-08-11T15:00:50Z", "nameservers": [ "agustin.ns.cloudflare.com", "janet.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T08:59:58Z", "analysis_at": "2026-10-20T13:45:50Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "first_seen": "2025-11-01T16:58:43Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.206.122" }, { "ttl": 21600, "type": "NS", "value": "janet.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "agustin.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.61.49" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "agustin.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::6815:3d31" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:ce7a" } ], "dns_at": "2026-10-20T13:54:32Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "mgmarket-6.at", "*.mgmarket-6.at" ], "issuer": "Google Trust Services / WE1", "serial": "8ead1baffb43a4ec0eaf66a39ff9da8e", "sha256": "ae3364b34ef2f9ba1686af28d1a72eadc00d85f21abb8ffc1ecb280b26ace2d6", "subject": "mgmarket-6.at", "valid_to": "2027-01-07T15:24:11Z", "valid_from": "2026-10-09T14:24:14Z" } } } ```