h2[.]farm777slot[.]com

This domain, h2.farm777slot.com, is flagged as a generic phishing site targeting users through a credential harvesting scheme. The page title 'Stealing food master' suggests an attempt to mimic gaming or reward-based platforms, likely aiming to trick victims into submitting login credentials or personal information under false pretenses. No direct association with a known drainer kit or legitimate brand was identified, but the use of WebAssembly indicates potential evasion techniques to bypass security controls. Analysis indicates the domain was registered through Amazon Registrar, Inc. on March 23, 2026, with an unusually future creation date that may indicate typo-squatting or domain generation algorithm (DGA) tactics. It resolves to IP address 18.245.31.61 and is hosted on Amazon Web Services infrastructure, leveraging Amazon S3 and CloudFront for content delivery. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is blocked by PhishDestroy. Additional technologies detected include Facebook Pixel, which may have been used for tracking or retargeting victims. As of the latest assessment, h2.farm777slot.com has been taken offline, reducing immediate risk to users. However, the infrastructure (IP, registrar, and cloud services) may still be active and repurposed for future campaigns. Organizations should monitor for related indicators, including the IP address 18.245.31.61 and domains registered through the same registrar with similar naming patterns. Users are advised to verify the legitimacy of gaming or reward-based websites before entering credentials and to report any suspicious activity to their security teams.