mctuslynm[.]com

PhishDestroy identifies mctuslynm.com as an active credential theft domain designed to harvest user login credentials under the guise of legitimate services. This domain mimics trusted login portals to trick victims into submitting usernames, passwords, or multi-factor authentication (MFA) codes, which are then exfiltrated to attacker-controlled servers. The threat actor behind this campaign leverages deceptive UI elements, such as cloned login pages, to exploit user trust and bypass security measures. Technical analysis reveals that mctuslynm.com resolves to IP 193.24.123.240 and utilizes a Let's Encrypt SSL certificate to appear legitimate, masking malicious intent behind a veneer of authenticity. This domain was flagged with a near-zero detection rate on VirusTotal, registering 4/95 detections at the time of analysis—a concerning indicator that traditional security tools have not yet flagged this threat. Additional intelligence links mctuslynm.com to NameSilo, LLC for domain registration and confirms its recent creation on April 23, 2026, suggesting opportunistic deployment of a newly registered domain (NRD) to evade blacklists. The absence of detections, combined with the domain’s freshness, underscores the need for proactive monitoring and user vigilance, as NRDs are a common tactic in credential theft campaigns. If you have visited mctuslynm.com or entered credentials, immediately change passwords for all accounts using the same login details and enable MFA where available. Revoke any sessions tied to the stolen credentials and scan devices for malware using reputable security software. Report the domain to your IT team or cybersecurity platform to prevent further exploitation. Avoid interacting with this domain entirely, and ensure your organization updates firewall rules and DNS blocklists to include 193.24.123.240 and mctuslynm.com to prevent future access.