soporte-mapas[.]us

This domain, soporte-mapas.us, is actively engaged in credential harvesting phishing operations targeting users through fraudulent login portals. Analysis indicates the infrastructure is designed to mimic legitimate mapping or location-based services, likely to deceive users into submitting sensitive authentication details such as usernames, passwords, or multi-factor authentication codes. The domain employs social engineering tactics, including urgency or false alerts, to prompt immediate user interaction and increase the likelihood of credential compromise. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 162.251.80.247, hosted on AS46606 (Unified Layer) in the United States. It is registered through Dynadot Inc and was created on June 03, 2026, suggesting a recently established operation. Security vendor detections on VirusTotal report 8 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (YR2), does not mitigate the underlying threat. The domain remains active as of the latest verification. Users who have visited soporte-mapas.us or interacted with any content hosted on this domain should immediately cease all engagement and take corrective actions. If credentials were entered, reset passwords for all associated accounts, particularly those sharing the same or similar login details. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, including logins from unfamiliar locations or devices. Organizations should update internal blocklists to include this domain and its resolving IP address, and consider implementing network-level protections to prevent access. Security teams are advised to review logs for connections to 162.251.80.247 or any subdomains of soporte-mapas.us to identify potentially compromised endpoints.