mahjongwin138[.]com

Analysis shows mahjongwin138.com was registered on April 09, 2026 through Dynadot Inc and is currently active. The site returns an HTTP 301 redirect and presents the title “MAHJONGWIN138 ! Situs Game Mahjong Terbaru Promosi Maksimal Untuk Semua Kalangan,” indicating a focus on Mahjong gaming promotions. The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming prior detection as malicious.

Infrastructure inspection reveals that mahjongwin138.com resolves to IP address 188.114.96.3, which is owned by Cloudflare, Inc. and geolocated in Canada. The domain uses Cloudflare’s DNS service, with authoritative nameservers blakely.ns.cloudflare.com and uriah.ns.cloudflare.com. A Let’s Encrypt/E7 TLS certificate secures the site, a common choice for short‑lived or abuse‑oriented deployments.

Threat indicators reinforce the malicious classification. Gridinsoft assigns the domain a trust score of 0 out of 100, the lowest possible rating. VirusTotal reports that 1 of 95 security vendors flagged the domain, providing at least one independent confirmation of suspicious activity. The declared scam type is a gaming scam, and the page content advertises a “maximal promotion” for Mahjong players, a typical lure used to harvest credentials or financial information from gamers.

Defenders should immediately block mahjongwin138.com at perimeter firewalls and DNS resolvers to prevent user access. Continuous monitoring of the associated IP 188.114.96.3 is advised, as Cloudflare may host additional malicious sites behind the same address. Security teams should also add the domain to internal threat‑intel feeds and educate users about unexpected gaming promotions that request login or payment details.