mbato.guru

This domain, mbato.guru, is flagged as a credential theft phishing operation targeting users through deceptive login portals. Analysis confirms the domain is currently offline, though it previously resolved to active infrastructure. The page title, 'For Sale Domain: mbato.guru,' suggests an attempt to mask malicious intent under the guise of a legitimate domain sale, a common tactic to evade detection during the initial setup phase of phishing campaigns. Infrastructure analysis reveals the domain was registered through Dynadot LLC on February 21, 2026, an unusually future-dated creation that may indicate domain squatting or preemptive registration for malicious use. It resolved to the IP address 54.215.31.113, hosted within Amazon.com, Inc.'s cloud network (AS16509) in the United States. The domain appears on one security blocklist, and 21 of 95 VirusTotal vendors have flagged it as malicious. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and fraudulent sites due to its low-cost, automated issuance process. While mbato.guru is currently offline, the domain's infrastructure and historical indicators warrant continued monitoring. Organizations should block the domain and its associated IP address (54.215.31.113) at the network perimeter to prevent potential future reactivation. Security teams are advised to review logs for connections to this IP or domain, particularly from February 2026 onward, to identify any prior compromise. Given the future-dated registration, additional scrutiny of domains registered through the same registrar with similar creation timestamps is recommended to preemptively disrupt related threats.