mantle-redirect-1761250125163-5xw3fcqr[.]pages[.]dev

PhishDestroy identifies an active brand impersonation campaign targeting Mantle through the malicious domain mantle-redirect-1761250125163-5xw3fcqr.pages.dev. This infrastructure functions as a cryptocurrency drainer, designed to deceive users into authorizing fraudulent transactions under the guise of legitimate Mantle services. The elevated risk level stems from its active status and the sophisticated impersonation tactics employed to harvest credentials and cryptocurrency assets. This domain resolves to IP address 172.66.45.26 and was registered through Cloudflare, Inc., leveraging the provider's pages.dev subdomain service. Security vendor analysis reveals minimal detection coverage, with only 1 out of 95 engines flagging this infrastructure as malicious on VirusTotal. The domain utilizes a Google Trust Services SSL certificate, enhancing its appearance of legitimacy. Notably, the certificate was issued to "Fake Mantle Web Console" during the active campaign window. These indicators combine to create a highly deceptive threat vector capable of bypassing traditional security controls. Organizations and individuals should implement immediate countermeasures by blocking both the domain and its resolving IP address at the network perimeter. Users must verify the official Mantle domains through multiple trusted sources before engaging with any web consoles or transaction interfaces. Implementing DNS sinkholing for this infrastructure and monitoring for similar Cloudflare Pages deployments can prevent further exploitation. This threat demonstrates the evolving tactics of cryptocurrency-focused impersonation campaigns that combine brand abuse with cloud provider services to maximize reach and credibility.