mhbannk[.]com

This domain, mhbannk.com, operates as a fraudulent banking portal designed to harvest user credentials through generic phishing techniques. Analysis indicates the site mimics legitimate financial institution interfaces to deceive visitors into entering sensitive login details, including usernames, passwords, and potentially multi-factor authentication codes. The threat actor likely employs social engineering tactics, such as urgent account verification requests or fake security alerts, to increase the likelihood of successful credential theft. Once obtained, stolen credentials may be used for unauthorized account access, financial fraud, or sold on underground markets for further exploitation.

Evidence supporting this assessment includes detection by 2 out of 95 security vendors on VirusTotal, with the domain appearing on 1 security blocklist. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 104.21.86.78, which has been observed in other phishing campaigns targeting financial institutions. AlienVault OTX records the domain in 1 threat intelligence pulse, further corroborating its malicious nature. The domain's current offline status suggests either takedown actions or temporary suspension by the threat actor to evade detection.

Users who visited mhbannk.com or entered credentials on the site should immediately take the following actions: reset passwords for all financial accounts, particularly those matching the impersonated institution, using strong, unique credentials. Enable multi-factor authentication where available to add an additional layer of security. Monitor account statements for unauthorized transactions and report any suspicious activity to the affected financial institution. If personal or financial information was disclosed, consider placing a fraud alert or credit freeze with major credit bureaus. Additionally, scan local devices for malware using updated security tools, as phishing sites may distribute secondary payloads or redirect to exploit kits.