maisonlopez.com used for credential harvesting phishing

The domain maisonlopez.com was registered on May 07, 2026 and currently resolves to the IP address 188.114.97.3. The address is owned by Cloudflare, Inc. and is located in Canada. HTTP requests to the domain return a 200 status code and the page title is reported as “Cloudflare”, indicating that the site is being served behind Cloudflare’s reverse‑proxy service. The SSL certificate presented by maisonlopez.com is issued by Google Trust Services under the WE1 designation, confirming that TLS termination is also performed by the Cloudflare edge network. Authoritative nameservers for the zone are huxley.ns.cloudflare.com and ligia.ns.cloudflare.com, both of which are standard Cloudflare delegations. Registration metadata shows the registrar as Cloudflare, Inc., suggesting the domain was created using Cloudflare’s privacy‑preserving registration process. Threat intelligence sources have begun to flag maisonlopez.com. AlienVault OTX includes the domain in one pulse, and the security blocklist managed by PhishDestroy has already added it, resulting in a single blocklist entry. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high‑risk assessment. VirusTotal currently reports 0 detections out of 95 scans, which does not imply benign intent but rather a lack of prior samples. Analysis indicates that the domain is being used for a generic phishing campaign, although the specific lure or targeted brand has not been disclosed. The recent creation date, Cloudflare‑only infrastructure, and rapid inclusion on a phishing‑focused blocklist suggest an opportunistic operation. Defenders should block the IP 188.114.97.3 and the domain maisonlopez.com at perimeter gateways, monitor DNS queries for the associated nameservers, and enforce TLS inspection to detect potential credential‑harvesting payloads. Ongoing observation is required to capture any additional indicators such as phishing page content or victim reports.