mahjong5000[.]rest

Analysis of mahjong5000.rest, a domain created on 24 March 2026 and currently taken offline, reveals a classic gaming‑focused phishing infrastructure. The site resolved to the Cloudflare IP address 104.21.51.148, which is geolocated to CA and is served through Cloudflare’s DNS resolvers deborah.ns.cloudflare.com and troy.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate‑looking HTTPS connection. An HTTP GET returned status 200 and the page title was captured as “Mahjong5000: Situs Game Online New Era Depo 5K Auto Sultan”, a clear indication of a gaming‑related lure. Front‑end libraries observed include Varnish, AMP, jQuery, SweetAlert2, Slick, Moment.js, MGID, and LiveChat, all of which are commonly employed by malicious actors to render interactive phishing pages.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans show that four out of ninety‑four security vendors flagged the domain, reinforcing the suspicion of malicious intent. Gridinsoft assigned a trust score of 0 / 100, the lowest possible rating, underscoring the high risk associated with the site. Registration was performed through Namecheap, a registrar frequently leveraged for disposable or short‑lived malicious domains.

Given the combination of a gaming‑oriented title, low trust scores, vendor detections, and blocklist presence, the infrastructure aligns with a generic phishing campaign targeting gamers, often termed a “gaming scam”. Defensive teams should add mahjong5000.rest to DNS blocklists, monitor for any re‑registration of the domain or its associated IP range, and inspect outbound traffic for connections to Cloudflare‑hosted IPs that match the observed patterns. Continuous vigilance for similar technology stacks and page titles is advised to pre‑empt future iterations of this scam.