mantle-portal-1761510377531-jkmki4dx[.]pages[.]dev

PhishDestroy identifies an active brand impersonation threat targeting Mantle users via the deceptive domain mantle-portal-1761510377531-jkmki4dx.pages.dev. This domain masquerades as the official Mantle portal to harvest credentials and sensitive data from unsuspecting victims. The threat actor leverages Cloudflare’s infrastructure, registered under the unique seed bdeb29, to host this malicious page resolving to IP 172.66.44.205. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating this threat has evaded conventional detection—highlighting the need for advanced threat intelligence. This domain was flagged for actively impersonating the Mantle brand, a Layer 2 scaling solution for Ethereum, to deceive users into entering login credentials or financial information. Registered through Cloudflare, Inc., the domain resolves to IP 172.66.44.205 and utilizes a Google Trust Services SSL certificate to appear legitimate. With 0 detections on VirusTotal as of the analysis, this threat evades traditional antivirus and firewall defenses. The unique seed bdeb29 further indicates this is a tracked, evolving campaign requiring immediate attention. If you visited this domain, assume your credentials or personal data may have been compromised. Disconnect from the internet temporarily to prevent potential lateral movement in your network. Change passwords for your Mantle account and any accounts using the same credentials immediately. Scan your devices with up-to-date antivirus software and consider enabling multi-factor authentication (MFA) where available. Report the domain to Mantle’s official security channels and block it at your network perimeter to prevent further exposure. Stay vigilant—brand impersonation attacks like this are increasingly sophisticated and targeted.