xn--mgmrket7-1ya[.]com

This domain, xn--mgmrket7-1ya.com (Punycode representation of an obfuscated Unicode string), is flagged as a generic phishing resource targeting cryptocurrency users. Analysis of the page title, krȧ43.cc, suggests an attempt to impersonate legitimate crypto exchange or wallet portals, likely aiming to harvest login credentials or deploy wallet-draining scripts. The domain exhibits characteristics of a low-sophistication but high-risk phishing campaign, leveraging Unicode obfuscation to evade casual detection and mimic trusted services. Technical indicators confirm the elevated risk profile. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abuse-prone registrations. It resolves to the IP address 101.99.76.111, hosted on infrastructure running Node.js, Ubuntu, and Nginx with an Express framework backend. Detection metrics reveal a VirusTotal score of 3/95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on a single security blocklist and employs a Let's Encrypt SSL certificate, a common tactic to feign legitimacy. No entries are present in Google Safe Browsing at the time of analysis. The domain has been taken offline, likely in response to detection by security mechanisms such as PhishDestroy. However, residual risk persists due to the registrar's history of hosting malicious domains and the potential for rapid redeployment of similar infrastructure. Users who interacted with this domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and its associated IP, while security teams should investigate related indicators for broader campaign linkages.