app.mdhgtyqm.xyz
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of app.mdhgtyqm.xyz
This domain appears to host a login page branded as "GanaMás," presented in Spanish and optimized for mobile users. The visible interface asks for a phone number and password and includes sign-in and registration options, suggesting it may be intended as an account-access portal for an online service or app.
The domain itself, app.mdhgtyqm.xyz, does not appear to match the visible brand name, and the hostname uses a generic-looking subdomain on a recently registered .xyz domain. Based on the screenshot and domain structure, the site may be functioning as a standalone authentication page rather than a full public-facing website, but the operator is not clearly identified from the available data.
Safety Assessment for app.mdhgtyqm.xyz
This site shows several cautionary signals at the time of this scan. It was flagged by 4 out of 91 security engines, primarily with suspicious or spam-related classifications. In addition, the domain is very new at roughly 93 days old, has no established traffic ranking, and the visible content is a credential-entry page on a domain name that does not clearly correspond to the displayed brand. That combination may increase the risk of impersonation or unauthorized credential collection.
At the same time, the malware scan did not identify malicious files, and major threat-database checks did not detect known malware or phishing listings at the time of review. However, clean blacklist results do not rule out abuse on a newly created site, especially when the page is primarily a login form with limited supporting business information. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is served through Cloudflare infrastructure and resolves to an IP address associated with that network in Toronto, Canada. It presents a valid SSL/TLS certificate issued by a mainstream certificate authority, which means the connection appears encrypted in transit. The nameservers also point to Cloudflare, indicating the site is using a reverse-proxy or CDN setup.
DNSSEC appears to be unsigned, so DNS responses may not benefit from that additional integrity layer. No malicious files were identified in the limited file scan, but the domain's recent registration, minimal observable content, and brand/domain mismatch are notable technical and operational concerns.
Share your experience with this website. Was it safe? Did you encounter any issues?