mgbx-portal[.]com

Analysis of the domain mgbx-portal.com indicates it was actively involved in a crypto scam impersonating the brand 'across' as of July 23, 2026. The domain was registered on January 4, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 186.2.175.29, hosted under AS59692 (IQWeb FZ-LLC) in Belize. The SSL certificate was issued by PhishDestroy, a provider associated with botadmin.destroy.tools, which is commonly linked to phishing infrastructure. The page title, 'MGBX ログイン | 安全な暗号通貨取引所 - MGBX Login,' suggests the site targeted Japanese-speaking users while masquerading as a cryptocurrency exchange.

At the time of assessment, the domain was flagged by one security blocklist and detected by 4 of 93 security vendors on VirusTotal, confirming its classification as malicious. The Gridinsoft trust score of 0/100 further supports its high-risk designation. The domain has since been taken offline, though its prior HTTP status returned a 200 code, indicating active malicious content was served. Nameservers associated with the domain include pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, and pns74.cloudns.uk, which are frequently utilized in phishing campaigns for their resilience and ease of setup.

Defenders should treat this domain as part of a broader crypto scam operation impersonating 'across.' While the domain is currently offline, organizations are advised to monitor for related infrastructure, including the IP 186.2.175.29 and associated nameservers, as threat actors may re-deploy similar domains. Blocking or sinkholing the IP and nameservers can mitigate residual risk. No additional details about the phishing kit or exact user interaction flow are available, as the site content has not been fully analyzed. Further investigation into the registrar, NiceNIC International Group Co., Limited, may reveal patterns in domain registration linked to this campaign.