mtg-life[.]net

mtg-life.net was registered through NameCheap, Inc. on 14 April 2026. Within two months of its creation the domain was flagged by multiple security services. VirusTotal reports that 16 of 91 scanning engines have identified the domain as malicious, and the domain is listed on one external blocklist. PhishDestroy has actively blocked traffic to the site, indicating that it is being used for a phishing campaign.

The threat classification in the intelligence set is “generic phishing”, and the current risk level is elevated with an active status. The available evidence confirms that the domain is being leveraged to harvest credentials or personal information, but no details about the hosting provider, IP address, SSL certificate, or page content have been published. Consequently, defenders lack visibility into the underlying infrastructure and cannot correlate the domain with known malicious payloads or command‑and‑control servers. Given the confirmed detections, defenders should immediately add mtg-life.net to deny‑list rules across perimeter firewalls, secure web gateways, and endpoint protection suites.

Network monitoring should be configured to alert on any DNS queries or HTTP requests to the domain, and any traffic observed should be blocked. Organizations should also review recent authentication logs for signs of credential submission to the domain and enforce multi‑factor authentication where possible. Because the domain is newly created, threat‑intel feeds may not yet contain full context; continued observation of related indicators such as new subdomains, changes in hosting, or additional blocklist listings is recommended. Until further infrastructure details become available, a precautionary block remains the most effective mitigation.