playmojo-aus[.]com

PhishDestroy identifies playmojo-aus.com as an active fake-login scam site hosting a crypto drainer. The threat level is under investigation, but the domain is already weaponized against Australian users expecting legitimate Mojo services. Threat actors register look-alike domains to harvest wallet credentials and initiate unauthorized token transfers. Early indicators show the site is operational and designed to deceive visitors into connecting wallets under false pretenses, risking loss of digital assets without additional malware deployment.

This domain was flagged via seed e831c7 and exhibits multiple red flags: it carries 0 detections out of 95 engines on VirusTotal, resolving to 172.67.150.203 with a Let's Encrypt SSL certificate issued recently. It was registered on March 17, 2026 through Fewmoretaps OU (d/b/a Trustname.com), a registrar known for rapid domain creation and minimal abuse oversight. The domain remains unlisted on major blocklists at discovery, indicating fresh deployment and low prior exposure. These factors combine to elevate the operational risk of user interaction despite the absence of traditional malware signatures.

Mitigation requires immediate avoidance: users should not visit or interact with playmojo-aus.com. If credentials or wallet connections were entered, revoke access via official Mojo Australia channels and transfer remaining assets to a clean wallet. Use PhishDestroy’s verification tool to cross-check domains before any login or transaction. Report the domain to Trustname.com, Let’s Encrypt, and local cybercrime units to accelerate takedown. Organizations should block 172.67.150.203 at the network perimeter and monitor DNS resolutions for related variants.