rajabodat138amp[.]xyz

This domain, rajabodat138amp.xyz, is actively flagged as a high-risk phishing site targeting online gaming credentials. Analysis indicates the domain was registered on August 26, 2025, through NameCheap, Inc., and currently resolves to the IP address 188.114.96.3. The page title explicitly references 'RAJABODAT138 - Best Website Gaming Online Login 2025,' suggesting an intent to deceive users into submitting login details for gaming platforms. The site employs modern web technologies, including Node.js, React, Next.js, AMP, and HTTP/3, alongside Cloudflare for hosting and security obfuscation. The presence of HSTS and a Google Trust Services SSL certificate may further lend a false sense of legitimacy to potential victims. Infrastructure analysis reveals the domain is associated with 24 threat intelligence pulses in AlienVault OTX, indicating widespread recognition of its malicious nature. Security vendors on VirusTotal have flagged the domain, with 12 out of 95 engines detecting it as malicious. Additionally, the domain appears on two security blocklists and is actively blocked by PhishDestroy and BLP-Malware. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk threat. The use of Webpack and Cloudflare suggests efforts to evade detection and analysis, complicating mitigation efforts. What remains uncertain is the exact scale of the campaign, including the number of victims or the specific gaming platforms being impersonated, as the page content has not been fully analyzed. Defenders should treat this domain as an active credential-harvesting threat. Immediate actions include blocking the domain and its resolving IP at the network level, updating endpoint protection signatures, and alerting users to avoid interaction with any communications or links referencing rajabodat138amp.xyz. Monitoring for related domains or IPs associated with the same infrastructure may help identify additional threats from this actor.