midas-buys[.]specialfors[.]com

The domain midas-buys.specialfors.com is currently active and engaged in brand impersonation, specifically impersonating PUBG MOBILE to deceive users into participating in a fraudulent event. This campaign employs social engineering tactics to trick victims into engaging with malicious content, posing a significant risk to unsuspecting users. The threat level is classified as high due to the active status and the specific targeting of a well-known gaming brand.

This domain was flagged by 17 of 95 VirusTotal security vendors, indicating a high probability of malicious activity. It was registered through Aceville Pte. Ltd., resolves to the IP address 104.21.85.93, and was created on January 23, 2026. The domain also appears on one security blocklist and holds an SSL certificate issued by Google Trust Services. The page title, 'Midasbuy x PUBG MOBILE Event,' explicitly mirrors legitimate collaborations to enhance credibility. These technical indicators, combined with the low trust scores and active status, confirm this as a credible threat.

PhishDestroy identifies this domain as an ongoing threat requiring immediate attention. Users and organizations are strongly advised to block midas-buys.specialfors.com at the network and endpoint levels. Additionally, updating DNS filters, email security gateways, and browser-based blocklists is critical to prevent access. Security teams should investigate any recent interactions with this domain and report the indicators of compromise (IOCs) to relevant threat intelligence platforms. Vigilance is essential, as this campaign preys on gaming enthusiasts and may evolve to evade detection.