mfgcapitalgroup[.]com

PhishDestroy identifies mfgcapitalgroup.com as a credential-harvesting domain masquerading as MFG Capital Group, posing an active and under-investigation threat. This domain is currently unflagged by VirusTotal (0/95 detections) and leverages a Google Trust Services SSL certificate to appear legitimate. Registered through GoDaddy.com, LLC, the domain resolves to IP 172.67.166.197 and was created on November 18, 2011.

The domain’s age and SSL certification suggest an attempt to evade immediate detection, while its lack of VirusTotal flags indicates limited exposure in automated threat feeds. The absence of blocklist mentions further underscores its potential stealthiness. The threat level remains under investigation due to these factors, but the credential-harvesting objective is clear given the impersonation of a financial services entity like MFG Capital Group.

Mitigation requires immediate action: users encountering this domain should avoid entering any credentials or sensitive data. Organizations should block both the domain and its resolving IP (172.67.166.197) at the network perimeter. Security teams should also scan for internal DNS queries to this domain and update threat intelligence platforms to flag its SSL certificate (Google Trust Services) as a potential indicator. Given its unflagged status, proactive hunting for related infrastructure is advised to prevent broader compromise.