rh[.]cloud-dirve[.]com

This domain, rh.cloud-dirve.com, is flagged for elevated risk due to its involvement in a credential theft campaign targeting cloud storage service users. Analysis indicates the page was designed to harvest login credentials by mimicking legitimate cloud drive interfaces, a common tactic in targeted phishing operations. The presence of the page title 'Phishing Simulation Notice' suggests an attempt to deceive users into believing the interaction was part of a security training exercise, lowering their guard against entering sensitive information. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain resolves to the IP address 20.50.64.14 and was registered through Dynadot Inc on March 25, 2026, an unusually future creation date that may indicate typosquatting or domain spoofing tactics. The SSL certificate is issued by Let's Encrypt (R13), a common choice for malicious actors due to its low-cost and automated issuance process. Security vendor detections on VirusTotal report 12 out of 95 engines flagging the domain as malicious, while it also appears on at least one security blocklist. These indicators collectively point to a coordinated effort to exploit trust in cloud storage services. To mitigate risks associated with credential theft campaigns, users should verify domain authenticity before entering login details, particularly when prompted by unsolicited emails or messages. Organizations are advised to implement multi-factor authentication (MFA) to reduce the impact of stolen credentials and conduct regular security awareness training to educate employees on recognizing phishing attempts. Network administrators should block access to the domain and its associated IP address (20.50.64.14) at the perimeter level. Additionally, monitoring for unusual login attempts or unauthorized access patterns can help detect and respond to potential breaches stemming from such phishing campaigns.