# PhishDestroy threat dossier — soporte-mapas.us ================================================================ Fetched: 2026-06-25 20:20:28 UTC Canonical: https://phishdestroy.io/domain/soporte-mapas.us/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 8/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Cluster25, CRDF, G-Data, Gridinsoft, SOCRadar, Sophos, Webroot Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 162.251.80.247 (US, Provo) Hosting org: AS46606 Unified Layer Registrar: Dynadot Inc Nameservers: ns1.md-79.webhostbox.net, ns2.md-79.webhostbox.net Registered: 2026-06-03 Expires: 2027-06-03 HTTP response: 530 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-18 Status: INVALID chain Fingerprint: cef5157d6ff88fe778d66a4ed6616f53bac5c905eaaa0a218b150ded6b2bd718 Subject Alternative Names (related infrastructure — often same operator): - 1-lcloud-l-com.us - 11-icloud.com - accounts-findmy.us - alertadeubicacion.online - appieid-supported.com - apple-col.com - apple-icloud.us - applefind.us - detect-device.us - devices-ifind.us - encontrar-mi-lphone.one - encontrarmaps.us - encontratmiiphone.us - find-mymapscloud.life - findingmyiphone.life ... +26 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-03 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-22 12:15:13 UTC (by PhishDestroy tracker) Last verified: 2026-06-25 20:20:35 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019eeed1-e18d-7559-a908-8fbc9e2a9a84/ Wayback Machine: https://web.archive.org/web/*/soporte-mapas.us crt.sh CT logs: https://crt.sh/?q=%25.soporte-mapas.us Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=soporte-mapas.us AlienVault OTX: https://otx.alienvault.com/indicator/domain/soporte-mapas.us URLhaus: https://urlhaus.abuse.ch/host/soporte-mapas.us/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 13:52:39 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, soporte-mapas.us, is actively engaged in credential harvesting phishing operations targeting users through fraudulent login portals. Analysis indicates the infrastructure is designed to mimic legitimate mapping or location-based services, likely to deceive users into submitting sensitive authentication details such as usernames, passwords, or multi-factor authentication codes. The domain employs social engineering tactics, including urgency or false alerts, to prompt immediate user interaction and increase the likelihood of credential compromise. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 162.251.80.247, hosted on AS46606 (Unified Layer) in the United States. It is registered through Dynadot Inc and was created on June 03, 2026, suggesting a recently established operation. Security vendor detections on VirusTotal report 8 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (YR2), does not mitigate the underlying threat. The domain remains active as of the latest verification. Users who have visited soporte-mapas.us or interacted with any content hosted on this domain should immediately cease all engagement and take corrective actions. If credentials were entered, reset passwords for all associated accounts, particularly those sharing the same or similar login details. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, including logins from unfamiliar locations or devices. Organizations should update internal blocklists to include this domain and its resolving IP address, and consider implementing network-level protections to prevent access. Security teams are advised to review logs for connections to 162.251.80.247 or any subdomains of soporte-mapas.us to identify potentially compromised endpoints. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: cef5157d6ff88fe778d66a4ed6616f53bac5c905eaaa0a218b150ded6b2bd718 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/soporte-mapas.us/ JSON API: https://api.destroy.tools/v1/check?domain=soporte-mapas.us Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 170,017 domains (14,706 alive under monitoring, 154,619 confirmed takedowns/dead). Site: https://phishdestroy.io