mahjongwin138h[.]vip

On July 12, 2026, mahjongwin138h.vip was identified as a high-risk domain engaging in generic phishing activities. The domain was created on March 22, 2026, and currently resolves to the IP address 104.21.55.25, which is hosted by Cloudflare, Inc. The domain's infrastructure is supported by nameservers miles.ns.cloudflare.com and beth.ns.cloudflare.com, indicating a potential use of Cloudflare's services to mask the true origin of the content. The page title 'MAHJONGWIN138 - Situs Mahjong Slot Gampang Menang Hari Ini' suggests that the domain is attempting to mimic a legitimate online gaming or gambling site, likely to lure unsuspecting users into providing sensitive information. The HTTP status code 301 indicates that the domain is performing a permanent redirect, possibly to another malicious site or to a page designed to collect user data. Analysis of the domain's technologies reveals the use of common web frameworks and libraries such as Bootstrap, AMP, SweetAlert2, Snowplow Analytics, Moment.js, LiveChat, jsDelivr, and jQuery CDN, which could be employed to create a convincing and functional phishing site. The domain has a Gridinsoft trust score of 0/100, indicating a complete lack of trustworthiness. It is also listed on one security blocklist, further corroborating its malicious nature. Defenders should immediately block access to this domain and monitor for any indicators of compromise, such as unauthorized data exfiltration or credential theft. Additionally, users should be educated to avoid clicking on links from unknown sources and to verify the legitimacy of any online gaming or gambling sites they visit.