find-alert-maps[.]click

This domain, find-alert-maps.click, was registered on February 17 2026 through Sav.com, LLC. The authoritative nameservers are dns1.dnspremium.pro and dns2.dnspremium.pro, and DNS resolution points to the IPv4 address 50.6.199.153, which is hosted by Oracle Corporation in the United States. An HTTP request returns a page titled “Access Denied” served by Apache HTTP Server; no TLS certificate is presented, indicating the site operates only over plain HTTP. Analysis by VirusTotal shows that fifteen of ninety‑four scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist. Commercial reputation services list a Gridinsoft trust score of zero out of one hundred, and the domain is currently blocked by the PhishDestroy mitigation service. The campaign is classified as credential phishing, targeting user credentials.

At the time of reporting the site has been taken offline. Evidence suggests a short‑lived infrastructure typical of opportunistic credential‑phishing campaigns. The lack of SSL, the generic “Access Denied” page, and the rapid takedown imply that the actors may have employed automated tools to host a temporary lure before abandoning the site. No additional indicators such as malware payloads, specific branding, or observed victim traffic are available, leaving the full scope of the operation uncertain. Defenders should add the domain and its associated IP address to local blocklists and ensure that any outbound connections to the host are denied.

Because the nameservers are hosted on dnspremium.pro, monitoring for future domains using the same nameserver pair can provide early warning of repeat activity. Continuous scanning of the IP range owned by Oracle Corporation for similar patterns is recommended, as is verification that internal users are not prompted to submit credentials to sites lacking TLS.