mail[.]cloud-lostdevice[.]us

The domain mail.cloud-lostdevice.us has been identified as a generic phishing infrastructure and is currently taken offline. Threat intelligence shows the domain carries a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trust. It appears on a single security blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that defensive networks have already taken mitigation steps. VirusTotal analysis records twelve detections out of ninety‑one scanned vendors, reinforcing the malicious classification.

The domain resolves to the IP address 207.174.215.249, which is attributed to AS46606 Unified Layer and geolocated to the United States. The TLS certificate presented is issued by Let’s Encrypt and is marked as a year‑2 renewal, which is typical for short‑lived malicious operators seeking encrypted communications. No authoritative name servers were resolved during the lookup, and the nameserver query returned NS_NOT_FOUND, suggesting the domain may have been deliberately removed from DNS after detection.

Although the site content has not been captured, the combined evidence from trust scoring, blocklist presence, vendor detections, and hosting attribution indicates a high likelihood of phishing activity targeting users who might receive emails appearing to originate from cloud‑based services. Defenders should continue to block the domain and its associated IP, add the IP to network‑level deny lists, and monitor for any re‑registration attempts or related domains hosted on the same AS. Ongoing surveillance of Unified Layer’s address space is advised, as adversaries often reuse infrastructure for subsequent campaigns.