mgbx-cn[.]at

On 24 July 2026 analysts observed that the domain mgbx-cn.at, registered on 27 February 2026 through the registrar Iqweb, resolves to the IP address 186.2.175.29 located in Belize and announced as AS59692 IQWeb FZ-LLC. The domain is served over HTTPS with a Let’s Encrypt R12 certificate and hosts front‑end libraries Ant Design, jQuery and Hammer.js, while traffic is protected by DDoS‑Guard. The page title returned by the live endpoint reads “MGBX 登录入口 | 安全数字资产交易平台 | MGBX 账户登录”, indicating an attempt to impersonate a login portal for a digital‑asset platform. VirusTotal reports that one of ninety‑three scanning engines flagged the domain, and the site is listed on a single public blocklist, currently blocked by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100, and the nameserver set consists of pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net and pns74.cloudns.uk. The site’s status is recorded as offline, preventing direct content inspection at the time of writing. Based on the combination of a recently created domain, a low‑trust SSL certificate, the presence of a phishing‑oriented page title, a positive detection from a security vendor, and inclusion on a phishing blocklist, the infrastructure is classified as a generic phishing operation targeting users of digital‑asset services.

Defenders should immediately add mgbx-cn.at and its resolved IP 186.2.175.29 to URL and IP blocklists, monitor the associated nameservers for future re‑use, and consider tightening email and web gateway filters for the “MGBX” keyword. Continuous re‑scanning of the domain is recommended in case the site becomes active again.