mahjongwin138[.]it[.]com

This domain, mahjongwin138.it.com, is flagged as an active generic phishing threat designed to harvest user credentials under the guise of a gaming or gambling platform. Analysis indicates no direct association with known brand impersonation templates or drainer kits, though the domain name suggests an attempt to exploit users searching for online mahjong or betting services. The lack of a confirmed brand tie increases the likelihood of opportunistic credential theft rather than a targeted brand spoof. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3 and was registered on April 09, 2026, through Intis Telecom Limited. At the time of assessment, the domain is detected by 3 out of 95 security vendors on VirusTotal, with no confirmed listings on Google Safe Browsing. It appears on a single security blocklist and is actively blocked by one anti-phishing system. The registration date, set in the future, may indicate an attempt to evade initial scrutiny or a data entry error in registration records. The domain remains active and poses an elevated risk to users who may encounter it through search engines, social media, or malicious advertisements. Current response actions include limited detection coverage, suggesting the threat may still evade some security controls. Users are advised to avoid interacting with the domain, and network administrators should consider blocking the IP 188.114.97.3 and monitoring for related subdomains. The remaining risk stems from low detection rates and the domain's continued operational status.