mahjongwin138f[.]vip

mahjongwin138f.vip is currently classified as a generic phishing site with a high risk rating. The domain was registered on March 04, 2026 through Dynadot LLC and remains active as of the report date, July 12, 2026. The public page presents a title “MAHJONGWIN138 - Situs Mahjong Slot Gampang Menang Hari Ini”, suggesting a fraudulent gambling lure aimed at Indonesian‑speaking users. Technical inspection shows the domain resolves to the Cloudflare address 188.114.96.3, hosted in the United States under AS13335. Authoritative nameservers are miles.ns.cloudflare.com and beth.ns.cloudflare.com, and the site serves HTTPS using a Let’s Encrypt certificate (issuer E8). Front‑end libraries detected include Bootstrap, AMP, SweetAlert2, Snowplow Analytics, Moment.js, LiveChat, jsDelivr, and jQuery CDN, indicating a typical modern web‑app stack but offering no evidence of malicious code beyond the phishing façade. Reputation data confirm the threat. PhishDestroy has already blocked mahjongwin138f.vip, and the domain appears on one external blocklist. VirusTotal scans report that 2 of 95 security vendors flagged the domain, while Gridinsoft assigns a trust score of 0 out of 100, reflecting a consensus of malicious intent. No additional intelligence on payload delivery or credential harvesting mechanisms has been published. Defenders should prioritize immediate blocking of mahjongwin138f.vip at perimeter and DNS layers, and consider sinkholing the associated IP address to disrupt any further traffic. Continuous monitoring of the Cloudflare nameservers for new sub‑domains is advised, as the infrastructure could be leveraged for additional phishing campaigns. Because the site’s content is limited to a gambling lure, analysts should also watch for credential‑stealing forms that may be added later, and update detection signatures accordingly.