sc-moonton[.]com

This domain is flagged for elevated risk due to targeted credential theft impersonating Mobile Legends: Bang Bang, a widely recognized mobile gaming platform. Analysis indicates the infrastructure is designed to harvest login credentials from unsuspecting players, enabling account takeovers and unauthorized in-game transactions. The threat type is classified as brand impersonation with credential theft objectives, distinct from generic phishing or financial fraud schemes. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain sc-moonton.com was registered on July 9, 2025, through CV. Jogjacamp, a registrar frequently associated with fraudulent activity. It resolves to IP address 103.28.53.147, hosted on AS136052 (PT Cloud Hosting Indonesia), a network segment with historical ties to malicious campaigns. The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious. Notably, the site lacks an SSL certificate, increasing the likelihood of plaintext credential transmission. The page title, 'Confirmation: Mobile Legends Bang Bang,' directly mimics official account verification processes, a common tactic in gaming credential theft operations. Mitigation steps for this specific threat type include immediate domain takedown requests to hosting providers and registrars, leveraging the provided IP and ASN data. Network defenders should implement DNS-based blocking for 103.28.53.147 and monitor for related domains registered through CV. Jogjacamp. End-user protection measures should focus on educating Mobile Legends players about official communication channels, emphasizing that legitimate account confirmations never occur through third-party domains. Organizations should deploy email and web filtering rules to block domains impersonating gaming platforms, particularly those created within the last 30 days. Incident responders should prioritize credential reset protocols for accounts interacting with this domain, as plaintext transmission risks are elevated due to the absence of SSL encryption.