# PhishDestroy domain threat record: mgmarket06.at

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mgmarket06.at/
Machine-readable companion: https://phishdestroy.io/domain/mgmarket06.at/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-25 03:27:35 UTC
- Last availability or vendor check: 2026-10-23 22:37:07 UTC
- Stored record updated: 2026-10-23 22:37:07 UTC
- VirusTotal detections in the stored snapshot: 6/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: edomains LLC ( https://nic.at/registrar/728 )
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d69b-8562-76cd-8dac-e59a88dc2a0d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mgmarket06.at
- Certificate Transparency search: https://crt.sh/?q=%25.mgmarket06.at
- Web Archive lookup: https://web.archive.org/web/*/https://mgmarket06.at/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
mgmarket06.at is an impersonation phishing page that presents itself as MEGA, the only name shown in its page title. The "mgmarket" wording and numbered suffix suggest one of a series of lookalike addresses meant to catch people searching for that brand. PhishDestroy first saw the domain on 2026-09-25. It was still online and serving content on 2026-10-19.

How the scam works
The page passes as MEGA by borrowing its name and look, so a visitor believes they have reached the real site. Pages like this usually put a login or account screen in front of the user. Anything entered there goes straight to the operators, including usernames, passwords, one-time codes and sometimes deposit or payment details. The victim can lose the account itself, plus any funds or crypto the operators can reach or talk them into sending to addresses they control.

Evidence
Six of 91 VirusTotal engines flagged the domain as of 2026-10-01: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, SOCRadar, VIPRE and desenmascara.me. That is a small share, but these six vendors work independently of each other and of PhishDestroy. The domain also appears in four AlienVault OTX threat pulses, so other researchers have tracked it as well. Of the blocklists checked, PhishDestroy is the only one listing it so far, which means many browsers and filters may still let it through.

Infrastructure
The .at domain is registered through edomains LLC. It sits behind Cloudflare at 188.114.97.3, geolocated to Canada, which hides the server that actually hosts the content. The Let's Encrypt certificate (YE2) gives the site a working padlock. That padlock only means the connection is encrypted and says nothing about whether the site is genuine.

What to do
If you typed a MEGA password on this page, change it right away from the official site or app. Also change it anywhere else you used the same password, and turn on or reset two-factor authentication. Check your account for unfamiliar sessions, devices or withdrawal addresses, and do not send anything the page asks you to deposit or "verify." If you already sent crypto, record the transaction details and report them to the exchange or service involved. Defenders should block mgmarket06.at and watch for sibling domains that use the same mgmarket naming pattern.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d69b-8562-76cd-8dac-e59a88dc2a0d/
VirusTotal report: https://www.virustotal.com/gui/domain/mgmarket06.at
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mgmarket06.at
Archived copy: https://web.archive.org/web/20260614103516/https://mgmarket06.at/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:43 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Qq80BCC/278e7d7c5f7f.png
  Captured: 2026-09-25 03:29:29 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d69b-8562-76cd-8dac-e59a88dc2a0d.png
  Captured: 2026-09-25 03:29:29 UTC
  Source report: https://urlscan.io/result/01a0d69b-8562-76cd-8dac-e59a88dc2a0d/
- URLScan capture 2: https://urlscan.io/screenshots/019ff82f-9a60-7778-84da-1637045a6a10.png
  Captured: 2026-09-25 03:27:35 UTC
  Source report: https://urlscan.io/result/01a0d69b-8562-76cd-8dac-e59a88dc2a0d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e9bf1947-0811-4ec6-a1bc-276b9fc1c8d7.png
  Captured: 2026-09-25 03:29:17 UTC
  Source report: https://radar.cloudflare.com/scan/e9bf1947-0811-4ec6-a1bc-276b9fc1c8d7
  SHA-256: 6fc8767e6aaa2f43217f41b6ac1e62e1356d06656d0c47d7d6e199b09898b6fb
- URLScan · 2026-08-12: https://screenshots.phishdestroy.io/us/019ff82f-9a60-7778-84da-1637045a6a10.png
  Captured: 2026-08-12 22:55:04 UTC
  Source report: https://urlscan.io/result/019ff82f-9a60-7778-84da-1637045a6a10/
  SHA-256: 975e91a5c1729118624ca76adee2e00750e89d0b60900187d3996e08a90324b0
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d69e-10bb-762f-b9e0-cf5e1c386d0b.png
  Captured: 2026-09-25 03:31:25 UTC
  Source report: https://urlscan.io/result/01a0d69e-10bb-762f-b9e0-cf5e1c386d0b/
  SHA-256: 6b55a5e16a3306c76197a67a1527c5e3f5c848e4dfa47f39bb0a3f44761ce679

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:00Z",
        "uuid": "01a0d69b-8562-76cd-8dac-e59a88dc2a0d",
        "scanned_at": "2026-09-25T03:28:38Z",
        "final_url": "https://mgmarket06.at/captcha/188877/index",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://mgmarket06.at/",
                "from": "https://mgmarket06.at/",
                "status": 301
            },
            {
                "to": "https://mgmarket06.at/captcha",
                "from": "https://mgmarket06.at/",
                "status": 307
            },
            {
                "to": "https://mgmarket06.at/captcha/188877/index",
                "from": "https://mgmarket06.at/captcha"
            }
        ],
        "ip": "188.114.97.3",
        "ips": [
            "188.114.97.3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "6f17b950accb91324d5cf4111b7f37541c47ba42d6e9433fc7fe42d37e7fb68a",
        "script_hashes": [
            "c4817313779c241cb9982ef39e0bcb8dd0af7130408ac477fdfba542215094ad"
        ],
        "globals": [
            "requestResize",
            "setFormEnabled",
            "startWait",
            "loadCaptcha",
            "captchaSecret",
            "waitTimer",
            "blankImg",
            "Ad",
            "config",
            "ad"
        ],
        "cookies": [
            "session_id"
        ],
        "tls": {
            "san": [
                "*.mgmarket06.at",
                "mgmarket06.at"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "mgmarket06.at",
            "protocol": "QUIC",
            "valid_to": "2026-12-14T20:06:51Z",
            "valid_from": "2026-09-15T20:06:52Z"
        },
        "domain_age_days": 507,
        "apex_age_days": 507,
        "tls_age_days": 9,
        "tls_valid_days": 89,
        "requests": 9,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 79,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=2592000; includeSubDomains; preload",
            "content-security-policy": "frame-ancestors 'self'",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:15Z",
        "uuid": "e9bf1947-0811-4ec6-a1bc-276b9fc1c8d7",
        "scanned_at": "2026-09-25T03:29:17Z",
        "final_url": "https://mgmarket06.at/captcha/182270/index",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://mgmarket06.at/",
                "status": 301
            },
            {
                "url": "https://mgmarket06.at/",
                "status": 307
            },
            {
                "url": "https://mgmarket06.at/captcha",
                "status": 200
            },
            {
                "url": "https://mgmarket06.at/captcha/182270/index",
                "status": 200
            }
        ],
        "dom_hash": "836212ffdb076ae3fa50560f2594a5eb0d75bacd2b5dc8107064a638478c6c49",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mgmarket06.at",
                "type": "A",
                "value": "172.67.197.141"
            },
            {
                "name": "mgmarket06.at",
                "type": "A",
                "value": "104.21.68.181"
            },
            {
                "name": "mgmarket06.at",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:44b5"
            },
            {
                "name": "mgmarket06.at",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c58d"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.197.141",
        "whois": {
            "registrar": "edomains LLC ( https://nic.at/registrar/728 )",
            "updated": "2026-09-15T22:30:07Z",
            "nameservers": [
                "luke.ns.cloudflare.com",
                "rosalie.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T18:11:06Z",
        "analysis_at": "2026-10-07T17:27:25Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious"
        },
        "reputation": 0,
        "popularity": {
            "Cloudflare Radar": 1000000
        },
        "registrar": "edomains LLC ( https://nic.at/registrar/728 )",
        "first_seen": "2025-05-06T15:47:16Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.68.181"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:44b5"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.197.141"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "luke.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c58d"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "luke.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "rosalie.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-07T17:29:18Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.mgmarket06.at",
                "mgmarket06.at"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "66c433e7e314dbe549c53dc397093e5a1e1",
            "sha256": "302a7d8cd93c7fe1ad6a2c09a9989bf3e178b494c6b1f8c0c890a9b1f972f012",
            "subject": "mgmarket06.at",
            "valid_to": "2026-12-14T20:06:51Z",
            "valid_from": "2026-09-15T20:06:52Z"
        },
        "whois": {
            "registrar": "edomains LLC ( https://nic.at/registrar/728 )"
        }
    }
}
```