give-reward[.]specialfors[.]com

This domain is flagged as an elevated-risk phishing site specifically designed to harvest credentials from PUBG MOBILE players. The threat involves luring victims with fraudulent in-game reward offers, then capturing login details through fake authentication portals. Analysis indicates this is a targeted credential phishing campaign rather than generic spam or malware distribution. Infrastructure analysis reveals the domain give-reward.specialfors.com was registered through Aceville Pte. Ltd. on February 21, 2026, an unusually future date suggesting possible domain age manipulation. It resolves to IP address 172.67.204.63 (AS13335 Cloudflare, Inc., US), leveraging Cloudflare's content delivery network to mask hosting origins. The domain appears on one security blocklist and is flagged by 21 out of 95 security vendors on VirusTotal. Its SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. The page title explicitly references PUBG MOBILE, confirming the targeted nature of this campaign. Mitigation requires immediate action from both network defenders and potential victims. Network-level protections should include DNS sinkholing for the domain and IP 172.67.204.63, along with web filtering rules to block requests to give-reward.specialfors.com. End users should be alerted to this specific threat, particularly those associated with PUBG MOBILE communities. Credential security measures include forcing password resets for any accounts exposed to this domain and enabling multi-factor authentication where available. Security teams should monitor for related domains registered through Aceville Pte. Ltd. or resolving to Cloudflare IPs, as these may indicate follow-up campaigns. The future creation date suggests possible domain generation algorithm usage, warranting closer scrutiny of newly observed domains with similar patterns.