mueleer[.]com

This domain, mueleer.com, is actively engaged in credential theft targeting FreePBX administrators. The site mimics the legitimate FreePBX Administration interface, presenting a fraudulent login portal designed to harvest authentication credentials. Analysis of the page title, 'FreePBX Administration,' confirms the impersonation of this widely used open-source PBX system, which is commonly deployed in enterprise VoIP environments. The threat actor’s objective is to gain unauthorized access to corporate communication systems, enabling further compromise of internal networks or toll fraud schemes. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on April 01, 2026, through Web Commerce Communications Limited dba WebNic.cc, a registrar frequently associated with malicious registrations. It resolves to IP address 104.21.18.112, which is hosted behind Cloudflare, a service often abused to conceal origin servers and evade takedowns. The site employs Let’s Encrypt SSL certificates, providing a false sense of security to victims. As of the latest scan, 21 out of 95 security vendors on VirusTotal have flagged this domain as malicious, with detections spanning phishing, fraud, and credential theft categories. Technologies detected include PHP, Bootstrap, jQuery, and Google Analytics, which are consistent with legitimate web applications but are exploited here to enhance the deception. Users who have visited mueleer.com or entered credentials on this site should assume compromise. Immediate actions include revoking and rotating all credentials associated with FreePBX or VoIP administration, particularly those used on or after the domain’s creation date. Network administrators should block the domain and its resolving IP (104.21.18.112) at the perimeter firewall and DNS level. Additionally, review logs for any outbound connections to this domain or IP, as such activity may indicate successful credential theft or ongoing compromise. Enable multi-factor authentication (MFA) on all FreePBX instances to mitigate the risk of unauthorized access. If credentials were entered, monitor for unusual call patterns or unauthorized configuration changes within the PBX system, as these may signal follow-on attacks such as toll fraud or internal network pivoting.