rdfgtyuhijokkujh[.]pages[.]dev

This domain is flagged as an active credential theft operation targeting users of the HV-MTL gaming platform. The site presents itself as the legitimate "Play HV-MTL Forge | Build. Flex. Fight. Evolve" portal, likely designed to harvest login credentials, payment details, or deploy malicious payloads under the guise of a gaming service. Visitors may be prompted to enter account information, download modified game clients, or complete fraudulent transactions, all of which could lead to account compromise or financial loss. Analysis indicates the domain was registered on March 28, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, hosted by Cloudflare in Canada. Despite its recent creation, the domain has already been added to 2 security blocklists, though it remains undetected by all 95 engines on VirusTotal as of this report. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security, as the domain’s infrastructure and registration patterns align with known credential theft campaigns. If you or a user under your purview visited this domain, immediate action is required. Disconnect the affected device from the network to prevent potential lateral movement or data exfiltration. Reset all credentials entered on the site, particularly those associated with gaming accounts, payment methods, or email services. Scan the device using updated endpoint detection tools to identify any downloaded artifacts or persistent threats. Monitor linked accounts for unauthorized activity, including transactions, password changes, or unusual login attempts. Report the incident to relevant security teams and consider notifying the legitimate HV-MTL platform to aid in broader mitigation efforts.