mg3[.]at

This domain, mg3.at, is identified as a credential harvesting phishing page designed to deceive users into disclosing sensitive authentication details, such as login credentials or multi-factor authentication codes. The threat specifically targets users through deceptive interfaces mimicking legitimate services, a tactic commonly employed in financially motivated phishing campaigns. Analysis indicates the domain was structured to evade initial detection while maximizing short-term impact before takedown. Infrastructure analysis reveals the domain resolves to the IPv6 address 2606:4700:20::681a:770 and is protected by Cloudflare, a content delivery network frequently leveraged to obscure malicious infrastructure. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains due to its free and automated issuance process. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on at least one security blocklist. The registrar details remain undisclosed, but the combination of Cloudflare obfuscation and rapid takedown suggests a deliberate effort to limit forensic traceability. Users who visited mg3.at or interacted with its content are advised to take immediate remediation steps. First, revoke any credentials entered on the site, particularly if they were reused across other platforms. Second, monitor associated accounts for unauthorized access or anomalous activity, including password reset attempts or unrecognized transactions. Third, report the incident to relevant security teams or fraud response units, providing the domain, timestamp of interaction, and any additional contextual details. Proactive measures, such as enabling multi-factor authentication and reviewing browser history for related domains, are recommended to mitigate further exposure.