Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@hostwinds.com.
The latest stored availability evidence still shows the domain reachable; 5 months has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
mobilelegends[.]gratiss[.]xyz
“Mobile Legends Diamonds Generator”
mobilelegends.gratiss.xyz — Belum terverifikasi. Jenis penipuan: Fake Airdrop. Ringkasan bukti: VirusTotal 12/91 (ADMINUSLabs, Chong Lua Dao, CyRadar, ESET, Forcepoint ThreatSeeker); URLQuery 3 alerts; CF Radar malicious; PhishDestroy score 92/100. Registrar: Go Daddy.
Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.
Analysis of mobilelegends.gratiss.xyz shows a short‑lived infrastructure used to host a fake Mobile Legends diamonds generator, a classic fake‑airdrop lure. The site was registered on 22 March 2026 through Go Daddy, LLC and resolved to the Hostwinds‑owned address 142.11.247.237 in the United States. DNS is served by dalbs105.hostwindsdns.com and dalbs106.hostwindsdns.com. The web server presented a Let’s Encrypt R12 certificate, indicating HTTPS was enabled, and responded with HTTP 403 for the initial request, suggesting the content was deliberately taken offline after detection. Static page metadata reveal the title "Mobile Legends Diamonds Generator" and the presence of Bootstrap, LiteSpeed, SweetAlert, jQuery and Google Hosted Libraries, with HTTP/3 support, consistent with a quickly assembled phishing landing page.
Threat intelligence feeds have flagged the domain: 18 of 94 VirusTotal scanners reported malicious activity, Gridinsoft assigned a trust score of 0 / 100, and the domain appears on one external blocklist. PhishDestroy has already blocked the site, and its current status is offline, confirming takedown. The combination of a low trust score, multiple vendor detections, and a dedicated blocklist entry underscores a high likelihood that the domain was employed for credential harvesting or malware distribution tied to the Mobile Legends brand.
Uncertainty remains regarding the exact payload delivered to victims, as no sandbox or payload analysis is available in the supplied data. Defenders should therefore treat any traffic to the IP 142.11.247.237 or to the domain name as malicious. Recommended actions include adding the domain and its IP to outbound and inbound deny lists, monitoring for similar naming patterns that combine game titles with free‑offer keywords, and reviewing internal logs for any attempted connections to the host during the brief window between registration and takedown.
Intelijen Keamanan Jaringan
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Cloudflare DNS | mobilelegends.gratiss.xyz |
malicious | Sinkholed |
| CIRA Canadian Shield DNS | mobilelegends.gratiss.xyz |
malicious | Sinkholed |
| DNS4EU | mobilelegends.gratiss.xyz |
malicious | Sinkholed |
Alur Tanggapan Ancaman Pipeline
Status Daftar Blokir Publik
Tangkapan tersimpan
Intelijen Domain
Rincian teknisDNS, SAN SSL, cap waktu
ICANN OVERSIGHT
Registration: gratiss.xyz
Akreditasi dan konteks RAA
Akreditasi dan konteks RAA
Registrar accreditation and DNS abuse obligations
For the registrable domain gratiss.xyz behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Teknologi · 6 identified
Popular CSS framework for responsive, mobile-first web development.
High-performance web server compatible with Apache configurations.
Fast, small JavaScript library simplifying HTML manipulation, event handling, and Ajax.
Third major version of HTTP protocol, built on QUIC for faster, more reliable connections.
Analisis VirusTotal
Analisis Performa Situs
Google PageSpeed Insights — mobile performance audit of mobilelegends.gratiss.xyz · checked Mar 19, 2026
Bukti & Laporan Eksternal
PD-20260319-C0D1A2 Recipient: abuse@hostwinds.com Apakah Anda Terpengaruh oleh Situs Ini?
Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Laporkan kepada Pihak Berwenang di Daerah Anda
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Periksa Domain Apa Pun
Analisis ancaman menggunakan daftar blokir yang disimpan, WHOIS, DNS, dan bukti pemindaian publik
Pindai SekarangLaporkan Phishing
Laporkan domain yang mencurigakan ke basis data ancaman kami — lindungi komunitas
LaporanPemberitahuan Ancaman Real-Time
Laporan phishing terbaru dan perubahan ketersediaan yang diamati
PantauTetap Terinformasi, Tetap Aman
Pantau ancaman secara langsung atau ajukan keberatan terhadap daftar ini jika Anda yakin ini merupakan false positive