mgm2[.]org

This domain is flagged as a high-risk credential theft operation targeting MGM Entertainment's Chinese user base. Analysis indicates the infrastructure is designed to harvest login credentials, payment details, or personal information under the guise of an official MGM China website. The threat actor has employed localized branding elements, including the page title '美高梅 (MGM)中国官方网站 - MGM ENTERTAINMENT,' to enhance legitimacy and deceive Mandarin-speaking victims. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain mgm2.org was registered on June 25, 2026, through Dynadot Inc, a registrar frequently abused for phishing campaigns. It resolves to the IP address 19.200.11.117, which has no prior association with legitimate MGM properties. Security vendors on VirusTotal detect the domain at a rate of 9/95, indicating moderate but consistent identification as malicious. The SSL certificate is issued by Let's Encrypt, a common tactic to create a false sense of security while avoiding the scrutiny associated with paid certificates. No reputable blocklists or trust scores currently list the IP or domain, suggesting the campaign remains undetected by some automated systems. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain mgm2.org and its resolving IP 19.200.11.117 at the firewall or DNS level to prevent access. Users who may have interacted with the site should reset credentials for any accounts entered, particularly those linked to financial services or corporate systems. Multi-factor authentication (MFA) should be enforced on all MGM-related accounts to mitigate credential reuse risks. Security teams are advised to monitor for unusual login attempts or data exfiltration patterns originating from the identified IP address. Given the localized targeting, awareness campaigns should emphasize the risks of brand impersonation in non-English phishing schemes.