mhsolutions-com-au[.]pages[.]dev

PhishDestroy has identified mhsolutions-com-au.pages.dev as an active crypto drainer phishing domain, designed to impersonate MHSolutions, an Australian IT services provider. This domain employs a fraudulent login portal to harvest credentials, specifically targeting cryptocurrency wallet users. The infrastructure leverages a Google Trust Services SSL certificate, likely to enhance credibility and evade browser-based warnings. This campaign is part of a broader trend where threat actors abuse legitimate cloud platforms, such as Cloudflare Pages, to host malicious content while masking their operations behind reputable services. This domain resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc. VirusTotal reports a detection ratio of 1/95 security vendors, indicating low but present visibility among security solutions. The domain was created recently, aligning with the active status observed in this advisory. Google Safe Browsing (GSB) has not yet flagged this domain, and it remains absent from major threat intelligence blocklists, which may contribute to its current effectiveness. The use of Pages.dev, a legitimate Cloudflare service, further complicates detection efforts by blending in with benign content. As of this advisory, the domain remains active with an elevated risk level, suggesting ongoing campaigns. Users are strongly advised to avoid interacting with this domain and verify its legitimacy through PhishDestroy or other trusted threat intelligence sources. Immediate action should be taken to block access to 188.114.96.3 at the network perimeter. While the current detection rate is low, the combination of active status, low VT score, and lack of GSB/blocklist coverage underscores the need for heightened vigilance. The risk of credential theft or cryptocurrency loss remains significant until this infrastructure is neutralized.