freefire[.]official-topup[.]com

This domain, freefire.official-topup.com, is identified as a brand impersonation threat specifically targeting Facebook gaming users, particularly those engaging with Free Fire top-up services. Analysis indicates the domain mimics legitimate in-game currency purchase platforms, presenting itself as an official or promotional vendor for Free Fire, a popular mobile game. The page title, 'Top Up Free Fire | Promo Terbaru | Codashop Indonesia,' further reinforces this deception by leveraging the branding of a well-known digital goods marketplace to lend credibility. No evidence of a crypto drainer kit was observed, but the domain’s structure and content are consistent with credential theft or fraudulent transaction schemes aimed at harvesting payment details or login credentials under false pretenses.

Infrastructure analysis reveals multiple technical indicators supporting the elevated risk assessment. The domain was registered on February 21, 2026, through Aceville Pte. Ltd., a registrar with a history of hosting high-risk domains. It resolves to the IP address 104.21.44.64, associated with Cloudflare, Inc. (AS13335), which is frequently utilized to obfuscate malicious infrastructure. Security vendor detection on VirusTotal stands at 17 out of 95, indicating moderate consensus on its malicious nature. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Notably, the domain lacks an SSL certificate, a red flag for user security, as it exposes data transmitted between the user and the server to interception or manipulation. No Google Safe Browsing (GSB) status is available, but the absence of encryption and the presence on blocklists are sufficient to classify this as a high-confidence threat.

As of the latest assessment, freefire.official-topup.com has been taken offline, likely in response to security vendor detections or blocklist inclusions. However, the residual risk remains elevated due to the domain’s recent creation date and the potential for re-activation or migration to a new infrastructure. Users who interacted with this domain should immediately revoke any credentials or payment details shared, as these may have been compromised. Organizations are advised to monitor for similar impersonation domains leveraging gaming or digital goods branding, particularly those targeting regional markets. Proactive measures include implementing domain monitoring tools, educating users on recognizing brand impersonation tactics, and enforcing multi-factor authentication to mitigate credential theft risks. The use of Cloudflare IP ranges by malicious actors underscores the need for continuous scrutiny of domains resolving to shared hosting providers, even when associated with reputable services.