midasbuy-update-rewatd[.]xuanbao[.]icu

This domain is flagged for elevated-risk brand impersonation targeting cryptocurrency wallet users through a fake PUBG MOBILE EVENT page. Analysis indicates the infrastructure is designed to deploy crypto drainer scripts, tricking victims into connecting wallets to malicious smart contracts under the guise of in-game rewards. The domain presents itself as an official promotion for the targeted brand, increasing the likelihood of successful social engineering. Infrastructure analysis reveals the following technical indicators: the domain midasbuy-update-rewatd.xuanbao.icu was registered on August 25, 2025, through Vantage of Convergence (Chengdu) Technology Co., Ltd. It resolves to IP address 45.207.204.6, hosted on AS8796 (FASTNET DATA INC) in the United States. No SSL certificate is present, and the domain is currently offline. VirusTotal reports 15 out of 95 security vendors flagging the domain, while it appears on two independent security blocklists: PhishDestroy and PhishingDB. The page title explicitly states 'PUBG MOBILE EVENT,' reinforcing the fraudulent reward theme. Mitigation requires immediate action from both users and security teams. Users who interacted with this domain should revoke all connected wallet permissions via blockchain explorers and monitor transaction histories for unauthorized activity. Security teams should add the domain, IP 45.207.204.6, and registrar details to blocklists, while also alerting users about fake in-game reward scams. Given the absence of SSL and the domain's recent creation, network-level filtering should prioritize domains registered through this registrar with similar naming patterns. Wallet providers should flag transactions originating from this IP range as suspicious.