mobileplay[.]info

This domain, mobileplay.info, is currently active and serves a page titled “Valorant Mobile”. The site resolves to IP address 104.21.26.208, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration details show that the domain was created on 21 February 2026 through NiceNIC International Group Co., Limited, and it uses Cloudflare nameservers brett.ns.cloudflare.com and priscilla.ns.cloudflare.com. HTTP responses return a 301 redirect and the TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid‑looking HTTPS endpoint. Threat intelligence indicates that four of ninety‑five VirusTotal scanners have flagged the domain, and it is listed on a single security blocklist. The domain is also blocked by the PhishDestroy filtering service. Detected infrastructure components include Stripe payment integration, Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support. The Gridinsoft trust score is 0 out of 100, reflecting a very low reputation. Analysis confirms the domain is being used for a high‑risk generic phishing campaign targeting users of the Valorant mobile game, although the exact content of the landing page has not been publicly dissected. Defenders should block traffic to mobileplay.info at network perimeter, monitor DNS queries for the associated Cloudflare nameservers, and add the IP 104.21.26.208 to blacklist rules. Continuous observation of any changes to the TLS certificate or redirection behavior is recommended.