bg[.]mycheckfanpages[.]sbs

This domain, bg.mycheckfanpages.sbs, is flagged as a generic phishing site targeting users through brand impersonation of Garena, a well-known digital entertainment platform. Analysis of the page title and historical captures confirms the domain presented a fraudulent login interface designed to harvest user credentials. No direct evidence of a crypto drainer kit was observed, though credential theft remains the primary objective of this campaign. Infrastructure analysis reveals the domain was registered through Dynadot LLC on March 04, 2026, and currently resolves to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. Detection metrics indicate elevated risk, with 18 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on a single security blocklist and is not currently listed in Google Safe Browsing. Additional forensic data includes a unique seed identifier (3aa332) for tracking this specific phishing campaign. As of the latest assessment, bg.mycheckfanpages.sbs has been taken offline, likely due to enforcement actions by the registrar or hosting provider. Despite its inactive status, residual risk persists for users who may have interacted with the domain prior to its removal. Organizations are advised to monitor network logs for connections to 188.114.97.3 and implement DNS-based blocking for the domain. End users should be alerted to verify the authenticity of any Garena-related communications and avoid entering credentials on untrusted platforms.