mgmarket6at-cc[.]xyz

The domain mgmarket6at-cc.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 172.67.190.50, an address owned by Cloudflare (AS13335) located in the United States. The authoritative nameservers are cruz.ns.cloudflare.com and nolan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was observed for the site, and the page title returned by the HTTP response is the Russian phrase “Один момент…”.

VirusTotal records show that four of ninety‑five scanning engines flagged the domain, suggesting the presence of malicious indicators. AlienVault OTX lists the domain in a single threat‑intel pulse, and the domain appears on one public blocklist, specifically PhishDestroy, which has already taken the site offline. The current status is reported as offline, limiting immediate interaction but confirming prior detection by security tooling. Evidence confirms that the domain is associated with a generic phishing campaign, yet the exact payload, targeted brand, or credential‑capture mechanism has not been disclosed publicly.

The lack of an SSL certificate, combined with the Cloudflare front‑end and the Russian page title, are consistent with temporary phishing landing pages designed to redirect or collect credentials. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the host under different subdomains, and consider sharing the indicator set with threat‑intel platforms to improve collective detection. Ongoing observation of the IP address and associated Cloudflare identifiers is advisable, as the infrastructure could be reused for future campaigns.