mdsends[.]info

This domain is flagged as an elevated-risk credential phishing site targeting users of a gaming currency platform. Analysis indicates the infrastructure was specifically designed to harvest login credentials under the pretext of offering free in-game currency, a common tactic in account takeover schemes. The domain’s page title, 'Add Robux,' directly references the targeted platform, increasing the likelihood of successful social engineering against users seeking unauthorized account benefits. Infrastructure analysis reveals the following technical indicators: the domain was registered through Dynadot Inc on April 18, 2026, and resolved to the IP address 91.218.49.169, located in Ukraine and associated with Virtual Systems LLC. The domain was flagged by 21 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on one security blocklist and was previously blocked by a specialized anti-phishing system. The SSL certificate, issued by Let's Encrypt (R12), suggests automated or low-cost deployment, consistent with phishing infrastructure observed in similar campaigns. The domain’s creation date, set in the future, may indicate an attempt to evade reputation-based detection systems or could be a data entry error during registration. Mitigation for this threat involves both technical and user-focused controls. Organizations should ensure that endpoint protection systems and network security tools are configured to block domains associated with this IP range (91.218.49.0/24) and registrar (Dynadot Inc), particularly those with recent creation dates or gaming-related themes. Security teams are advised to monitor for credential submission attempts to this domain in historical logs, as compromised accounts may still be exploited even after the domain’s takedown. User awareness training should emphasize the risks of 'free currency' offers, highlighting that legitimate platforms do not distribute in-game assets through third-party domains. Additionally, domain registrars and hosting providers should be notified of abuse patterns associated with this infrastructure to facilitate proactive takedowns of related assets.