midasbuy[.]nett[.]to

The domain midasbuy.nett.to was registered on February 21, 2026 through Spaceship, Inc. and resolves to the IP address 45.207.204.8, which is assigned to AS8796 FASTNET DATA INC in the United States. The authoritative nameservers are vip7.alidns.com and vip8.alidns.com, and the site presented a TLS certificate issued by Let’s Encrypt (R10). An HTTP request to the root returned a 404 status code, and the page title observed during the brief scan was "PUBG MOBILE EVENT," which does not directly reference the targeted brand. VirusTotal analysis recorded 18 detections out of 93 security vendors, indicating that a substantial portion of scanners flagged the domain as malicious.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. The threat classification is brand impersonation, specifically targeting the brand "argent," and the risk level is elevated. Current status shows the domain as taken offline, but the indicators remain relevant for defensive monitoring. Defenders should add the domain and its associated IP address to DNS and URL filtering rules, monitor for any re‑registration attempts, and ensure that any traffic to the identified nameservers is inspected.

Continuous observation of the Let’s Encrypt certificate issuance patterns for these nameservers is advised, as they may be reused in future campaigns. Correlation with other incidents that reference the same IP or registrar may reveal additional infrastructure reuse. The limited blocklist presence suggests that broader community awareness may still be developing, so sharing the observed indicators with threat‑intel platforms can improve collective detection capabilities.