mulberry-1781178573377[.]staticrun[.]app

This domain, mulberry-1781178573377.staticrun.app, is identified as a credential theft operation designed to harvest user login credentials through deceptive web forms. Analysis indicates no direct brand impersonation, but the infrastructure mimics legitimate static hosting services to evade detection. The threat actor likely employs social engineering tactics, such as fake login prompts or account verification requests, to trick victims into submitting sensitive information. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 12, 2026, through CloudFlare, Inc., and resolves to the IP address 5.161.68.219. It is flagged by 22 out of 95 security vendors on VirusTotal, with a presence on one security blocklist. The domain uses a Let's Encrypt SSL certificate (YR1), which is commonly exploited to lend an appearance of legitimacy. Google Safe Browsing status is not explicitly provided, but the domain's inclusion on a blocklist and its VirusTotal score suggest active malicious intent. The domain is currently offline, likely taken down in response to security alerts or abuse reports. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or repurpose the IP address for future campaigns. Users who interacted with the domain should monitor for unauthorized access to accounts and enable multi-factor authentication where possible. Organizations are advised to block the domain and associated IP at the network level to prevent potential re-emergence or lateral movement within compromised environments.