mfgcapgroup[.]com

PhishDestroy identifies mfgcapgroup.com as an active business email compromise (BEC) phishing domain with elevated risk to enterprise environments. This domain employs deceptive tactics to impersonate legitimate financial entities, potentially tricking employees into initiating unauthorized wire transfers or disclosing sensitive credentials. The infrastructure supporting this campaign shows signs of opportunistic hosting, with low detection rates across major security platforms, indicating a stealthy operation likely targeting mid-sized organizations.

This domain was flagged by only 2 out of 95 VirusTotal security vendors, suggesting poor detection coverage despite clear malicious indicators. DNS resolution points to IP address 188.114.97.3, which is associated with suspicious hosting activity across multiple regions. Registration details reveal the domain was created on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for lax oversight of fraudulent registrations. The SSL certificate issued by Let's Encrypt may lend false legitimacy to phishing pages hosted on this infrastructure. The low detection rate (2/95) combined with the recent domain age creates a concerning profile for organizations evaluating this threat.

Organizations should immediately block mfgcapgroup.com at DNS and firewall levels due to its confirmed BEC phishing status. Implementing strict email filtering rules to quarantine messages referencing financial transactions or urgent payment requests from this domain is critical. Security teams should inspect outbound traffic to IP 188.114.97.3 for anomalous connections, particularly from finance departments. Conducting user awareness training highlighting the risks of credential harvesting through deceptive domains completes the defensive strategy. Immediate takedown requests should be submitted to the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED while monitoring for newly registered variants of this domain pattern.