midasbuy-datagokjp[.]mc[.]hi[.]cn

The domain midasbuy-datagokjp.mc.hi.cn is confirmed as a brand impersonation phishing site targeting Facebook users. Analysis indicates the site masqueraded as a PUBG MOBILE EVENT, likely to deceive victims into disclosing credentials or personal information under false pretenses. The domain is currently offline, but prior activity aligns with known phishing campaigns leveraging gaming-themed lures to exploit social media users.

Technical indicators reveal the domain was registered on December 30, 2024, through 阿里云计算有限公司（万网）, a registrar frequently associated with malicious infrastructure. It resolved to the IP address 45.207.204.6, hosted under AS8796 (FASTNET DATA INC) in the United States. VirusTotal detections show 18 of 95 security vendors flagged the domain as malicious, while it appears on one security blocklist. The absence of an SSL certificate further undermines its legitimacy, as modern phishing sites typically employ encryption to evade detection.

Given the domain's current offline status, immediate risk to users is reduced. However, the infrastructure may resurface under a different name or subdomain. Organizations and individuals are advised to block the domain and its associated IP (45.207.204.6) at the network level. Users who interacted with the site should reset credentials for Facebook and any linked accounts, enable multi-factor authentication, and monitor for unauthorized activity. Security teams should review logs for connections to the domain or IP and correlate with other indicators of compromise.