ccehsa-m188[.]pages[.]dev

The domain ccehsa-m188.pages.dev is currently active and flagged as a credential theft operation targeting users of online slot gaming platforms. Analysis indicates this is not a generic phishing attempt but a specialized campaign designed to harvest login credentials, payment details, and personal information from individuals seeking alternative access to licensed gambling sites. The page title, "MDG188 - Link Alternatif Resmi Menempuh Slot Online Terlisensi Dan Terpopuler No #1," explicitly references MDG188, a known online slot brand, suggesting direct impersonation to lend credibility to the fraudulent site. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 02, 2026, and resolves to the IP address 172.66.46.230, hosted under AS13335 (Cloudflare, Inc.) in the United States. Security vendor detection is notable, with 6 of 95 VirusTotal engines flagging the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The use of Cloudflare's infrastructure further complicates attribution, as it masks the true origin of the hosting server. Current monitoring confirms the domain remains active and operational. Organizations and individuals are advised to block access to 172.66.46.230 and ccehsa-m188.pages.dev at the network perimeter. Endpoint protection should be updated to include this domain in deny lists, and users should be educated to recognize the specific page title and branding (MDG188) as indicators of fraud. Given the high-risk nature of credential theft, affected users should immediately reset passwords and monitor financial accounts for unauthorized activity. Security teams are encouraged to review logs for connections to the IP or domain to identify potential compromises.