mail[.]maps-locate-isupport[.]com

Analysis of mail.maps-locate-isupport.com shows that the domain was created on 2026-04-17 and is registered through Atak Domain. The authoritative name servers are ns1.md-7.webhostbox.net and ns2.md-7.webhostbox.net, which resolve the domain to the IPv4 address 207.174.212.196. The hosting provider associated with the IP belongs to a web-hosting service that frequently appears in malicious infrastructure, but no additional attribution is available in the current data set. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, indicating that at least one defensive feed has observed malicious use.

VirusTotal scans report that 16 of 91 security vendors flag the domain as malicious, reinforcing the suspicion of abuse. No public Safe Browsing, OTX, or SSL certificate details are provided in the intelligence feed, and the page title or HTTP response code have not been captured, leaving those surface-level indicators unverified. Given the classification as a generic phishing campaign, the observable infrastructure suggests a deliberately provisioned domain intended to host credential-stealing pages. The short lifespan—creation less than four months before the report date—matches typical phishing operational patterns.

Defenders should continue to block the domain at DNS and proxy layers, monitor outbound connections to 207.174.212.196, and add the domain to internal blocklists. Additional investigation, such as retrieving the HTTP response and page content, would confirm the phishing payload and allow correlation with other campaigns. Until further evidence is gathered, the domain remains an elevated-risk indicator that should be treated as active malicious infrastructure.