mgmarket4[.]at

The domain mgmarket4.at is currently active and resolves to the IP address 188.114.96.3. DNS resolution is served by the Cloudflare nameservers bryce.ns.cloudflare.com and magdalena.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare's edge network. Registration data shows the domain was created through the registrar Docky, with the listed contact person Huang Chao Ming, as recorded in the Austrian NIC registry (https://nic.at/registrar/723). The domain has been observed on a single security blocklist and is explicitly blocked by the PhishDestroy mitigation service, reflecting its classification as a high‑risk phishing infrastructure. VirusTotal analysis reports that two out of ninety‑five scanning engines flagged the domain, providing additional corroboration of malicious intent.

No public page title, SSL certificate details, or HTTP response codes have been published in the available intelligence, leaving the exact content and delivery mechanism of the phishing campaign undocumented. Consequently, defenders cannot confirm which brand or service the phishing lure may impersonate, nor can they assess the presence of credential‑stealing forms. The use of Cloudflare as a CDN is common among phishing operators to obscure the true origin of the server and to leverage the provider's high availability. Historical analysis of similar domains hosted on the same IP range shows a pattern of rapid deployment and takedown, suggesting a short‑lived campaign designed to harvest credentials before detection. The limited detection (2/95) may reflect the early stage of the campaign or evasion techniques that avoid triggering additional scanners.

Organizations that have observed credential‑phishing attempts targeting their users should verify whether any recent malicious emails contain links to mgmarket4.at, and if so, treat those communications as compromised.