# PhishDestroy domain threat record: mgmarket11.at

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mgmarket11.at/
Machine-readable companion: https://phishdestroy.io/domain/mgmarket11.at/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-16 01:37:54 UTC
- Last availability or vendor check: 2026-10-23 22:01:40 UTC
- Stored record updated: 2026-10-24 02:22:00 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.73.143
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2024-12-06 08:29:34 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1425b-d407-766e-a7fb-6410f0465f47/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mgmarket11.at
- Certificate Transparency search: https://crt.sh/?q=%25.mgmarket11.at
- Web Archive lookup: https://web.archive.org/web/*/https://mgmarket11.at/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
mgmarket11.at is classified by PhishDestroy as an impersonation phishing page. It presents itself as a trusted service so visitors will log in or share sensitive details. PhishDestroy first saw it on 2026-10-16. As of 2026-10-19 the site was alive with content still being served.

How the scam works
Impersonation sites copy the name, look and wording of a real platform and wait for users who arrive through search results, ads, messages or mistyped addresses. Anything typed into the fake page, such as usernames, passwords, one-time codes or payment and account details, goes straight to the operators. They can then take over the real account and move funds or data out of it. The page title shows a Cloudflare "521: Web server is down" error, while PhishDestroy classifies the domain as an impersonation phishing page.

Evidence
Independent detection is currently absent. VirusTotal returned 0 detections out of 92 engines on 2026-10-16. PhishDestroy is the only blocklist listing the domain so far. Because a clean scan does not mean the site is safe, users should rely on the PhishDestroy classification and stay away from it.

Infrastructure
The domain uses the Austrian .at extension and sits behind Cloudflare, Inc. network address 172.67.73.143, which geolocates to Canada. Cloudflare acts as a proxy, so the actual origin server is not exposed. The TLS certificate was issued by Google Trust Services (WE1). The padlock only means the connection is encrypted and says nothing about whether the site is legitimate.

What to do
If you visited mgmarket11.at but entered nothing, close the tab and clear your browser history and cache. If you typed a password or other login details, change that password right away on the genuine service and on any other account that uses the same one. Turn on two-factor authentication and review recent logins and transactions. If you shared payment or banking details, contact your bank or card issuer. Security teams should block the domain at DNS, proxy and email gateways, add it to internal threat feeds, and report it to Cloudflare and the .at registry for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1425b-d407-766e-a7fb-6410f0465f47/
VirusTotal report: https://www.virustotal.com/gui/domain/mgmarket11.at
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mgmarket11.at
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:22:24 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1425b-d407-766e-a7fb-6410f0465f47.png
  Captured: 2026-10-16 01:37:54 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1425b-d407-766e-a7fb-6410f0465f47.png
  Captured: 2026-10-16 03:30:21 UTC
  Source report: https://urlscan.io/result/01a1425b-d407-766e-a7fb-6410f0465f47/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1e162d84-9a45-4f5a-8ace-f3543ac8f284.png
  Captured: 2026-10-16 01:50:16 UTC
  Source report: https://radar.cloudflare.com/scan/1e162d84-9a45-4f5a-8ace-f3543ac8f284
  SHA-256: 971c5e7dafdfdc418801f73b45e5bd500b88fcf2ca8b017141f6363e9bb3d7d8
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1421c-14b6-754d-8185-3f9ab12bded1.png
  Captured: 2026-10-16 00:28:24 UTC
  Source report: https://urlscan.io/result/01a1421c-14b6-754d-8185-3f9ab12bded1/
  SHA-256: 858bbb3266258a2214c06b620a0493deb03ed763a847c3d8fcac04acec1346ef
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14220-d3e8-733c-af33-e78f1e0f816f.png
  Captured: 2026-10-16 00:33:35 UTC
  Source report: https://urlscan.io/result/01a14220-d3e8-733c-af33-e78f1e0f816f/
  SHA-256: d3c614aede49a14656a54d6ef5ca0a76a669377f2311426f6a07bcd62f69f5d7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:46:07Z",
        "uuid": "01a1425b-d407-766e-a7fb-6410f0465f47",
        "scanned_at": "2026-10-16T01:38:03Z",
        "final_url": "https://mgmarket11.at/",
        "status": 521,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://mgmarket11.at/",
                "from": "http://mgmarket11.at/",
                "status": 307
            }
        ],
        "ip": "172.67.73.143",
        "ips": [
            "172.67.73.143"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com",
            "developers.cloudflare.com"
        ],
        "doc_hash": "1f320c906a46a4fad23940bc5ae174482ecc7e1328f46cf789db55b09be71cf4",
        "tls": {
            "san": [
                "mgmarket11.at",
                "*.mgmarket11.at"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "mgmarket11.at",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-29T15:08:02Z",
            "valid_from": "2026-08-31T14:08:18Z"
        },
        "domain_age_days": 55,
        "apex_age_days": 55,
        "tls_age_days": 45,
        "tls_valid_days": 90,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 82,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:59:22Z",
        "uuid": "1e162d84-9a45-4f5a-8ace-f3543ac8f284",
        "scanned_at": "2026-10-16T01:50:16Z",
        "final_url": "https://mgmarket11.at/",
        "status": 521,
        "history": [
            {
                "url": "https://mgmarket11.at/",
                "status": 521
            }
        ],
        "dom_hash": "44f83b86670a53701e60f71195a3f41260783e3e1297f0ec6a48f6f4d16a372e",
        "doc_hash": "94eb6052739255b732b6c466624c853aca9e03023f0dabe29e74acc212689c6f",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mgmarket11.at",
                "type": "A",
                "value": "104.26.12.132"
            },
            {
                "name": "mgmarket11.at",
                "type": "A",
                "value": "172.67.73.143"
            },
            {
                "name": "mgmarket11.at",
                "type": "A",
                "value": "104.26.13.132"
            },
            {
                "name": "mgmarket11.at",
                "type": "AAAA",
                "value": "2606:4700:20::ac43:498f"
            },
            {
                "name": "mgmarket11.at",
                "type": "AAAA",
                "value": "2606:4700:20::681a:c84"
            },
            {
                "name": "mgmarket11.at",
                "type": "AAAA",
                "value": "2606:4700:20::681a:d84"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.26.12.132",
        "whois": {
            "created": "2024-12-06T09:29:34Z",
            "updated": "2026-08-31T16:32:25Z",
            "nameservers": [
                "renan.ns.cloudflare.com",
                "rosalie.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T19:45:40Z",
        "analysis_at": "2026-10-20T02:00:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "first_seen": "2025-05-16T19:28:17Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "rosalie.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "renan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:20::681a:c84"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.26.12.132"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:20::ac43:498f"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.26.13.132"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.73.143"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:20::681a:d84"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "renan.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-20T02:00:20Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "mgmarket11.at",
                "*.mgmarket11.at"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "973026a5aa527d340ef5eec583d69f89",
            "sha256": "3c153fafadf6b60686f4faf68b82efd8a470b085bfbfe606ce1350e48c53b059",
            "subject": "mgmarket11.at",
            "valid_to": "2026-11-29T15:08:02Z",
            "valid_from": "2026-08-31T14:08:18Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T15:51:51Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "mgmarket11.at"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.57",
                    "host": "rosalie.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.62",
                    "host": "renan.ns.cloudflare.com"
                }
            ],
            "zone": "mgmarket11.at"
        },
        "location": {
            "ip": "2606:4700:20::681a:d84",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "mgmarket11.at"
        },
        "dns": {
            "A": [
                "104.26.12.132",
                "172.67.73.143",
                "104.26.13.132"
            ],
            "NS": [
                "rosalie.ns.cloudflare.com",
                "renan.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"renan.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2413964399, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:20::681a:c84",
                "2606:4700:20::ac43:498f",
                "2606:4700:20::681a:d84"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:20::681a:c84",
            "family": 6
        },
        "whois": {
            "created": "2024-12-06T09:29:34Z",
            "updated": "2026-08-31T16:32:25Z",
            "nameservers": [
                "renan.ns.cloudflare.com",
                "rosalie.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "x-frame-options": "SAMEORIGIN",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```