new[.]mahealthconnextor[.]org

Analysis of the domain new.mahealthconnextor.org indicates a confirmed brand impersonation phishing campaign targeting Connext, classified with an elevated risk level. The domain was registered through Epik LLC on February 7, 2020, and is currently offline as of July 24, 2026. Infrastructure analysis reveals the domain resolves to the IP address 139.162.174.209, hosted on Akamai Connected Cloud (AS63949) in Germany. Nameservers are provided by GiantPanda (meilan.ns.giantpanda.com and chuangchuang.ns.giantpanda.com), a pattern observed in other phishing operations.

Detection metrics show limited but targeted coverage: the domain appears on one security blocklist, and three of 95 security vendors on VirusTotal flagged it as malicious. Gridinsoft assigned a trust score of 0/100, reinforcing the classification as high-risk. The absence of an SSL certificate further aligns with common phishing infrastructure characteristics. The page title, 'mahealthconnextor.org,' directly references the impersonated brand, supporting the brand impersonation classification.

Defenders should treat this domain as part of a broader campaign leveraging similar naming conventions and hosting providers. While the domain is currently offline, monitoring for re-activation or related domains using the same registrar or nameserver infrastructure is recommended. No evidence of widespread detection by major browser-based protection systems (e.g., Google Safe Browsing) was present in the available data, suggesting the campaign may have operated with limited visibility prior to takedown. The exact content or phishing kit used remains unconfirmed, as no forensic analysis of the page was conducted.