midasbuyt[.]xtgood[.]shop

The domain midasbuyt.xtgood.shop was registered on July 02, 2025 through Chengdu west dimension digital technology Co., LTD and is currently taken offline. DNS resolution points to IP address 45.207.204.6, which is announced by AS8796 FASTNET DATA INC and geolocated to the United States. The domain is served from Cloudflare name servers nitin.ns.cloudflare.com and olivia.ns.cloudflare.com, indicating use of a third‑party content delivery network for hosting. No SSL certificate is presented, leaving the HTTP service unencrypted and exposing any transferred data to interception.

The page title returned by the site, "PUBG MOBILE EVENT," does not reference the targeted brand, yet the intelligence explicitly classifies the activity as a Facebook brand impersonation, confirming the intent to mislead users into believing the site is affiliated with Facebook. Detection metrics show that 17 of 95 security vendors on VirusTotal have flagged the domain as malicious, and it is listed on a single public blocklist. The Gridinsoft trust score of 0 out of 100 further reinforces the malicious reputation. PhishDestroy has already added the domain to its blocklist, indicating that at least one anti‑phishing service is actively preventing user access.

Evidence for the impersonation claim is limited to the declared brand target; no visual or content analysis is available because the site is offline. Uncertainty remains around the specific payload or credential‑harvesting mechanisms, as no SSL, page content, or redirect behavior has been captured. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules with the exact domain name, and monitor for any resurgence of the same host or associated IP address. Additional investigation of the hosting provider FASTNET DATA INC and the Cloudflare name servers may reveal other malicious domains sharing the same infrastructure, warranting broader threat‑intel correlation.