mail[.]id-myphone[.]us

On July 29, 2026, the domain mail.id-myphone.us was observed actively serving a generic phishing campaign. DNS resolution returns a single A record pointing to 207.174.212.196; the authoritative nameserver query failed, yielding NS_NOT_FOUND, which suggests either a misconfiguration or use of dynamic DNS. The IP address is currently listed on one public security blocklist, indicating prior abuse. VirusTotal reports that 18 of 91 scanned security vendors flagged the domain as malicious, reflecting a moderate consensus of compromise.

The domain is also listed in the PhishDestroy blocklist, confirming that at least one dedicated anti‑phishing service has taken it down. No HTTPS certificate information is available, and attempts to retrieve HTTP response headers have not yielded a definitive status code, leaving the web server behavior undocumented. The page title and content have not been captured, so the exact lure or credential‑harvesting vector cannot be described. Likewise, no Safe Browsing, OTX, or registrar reputation data were found in the current intelligence set.

Given the confirmed resolution to a known malicious IP, presence on multiple blocklists, and multi‑vendor detection, defenders should treat mail.id-myphone.us as a high‑confidence phishing indicator. Recommended actions include adding the domain and its IP address to outbound and inbound firewall deny lists, updating URL filtering policies to block both the domain and any sub‑domains, and monitoring DNS logs for any queries to the domain. Incident response teams should also correlate any recent authentication attempts or credential submissions that may have originated from this host. Continuous re‑evaluation is advised, as additional intelligence such as SSL certificates, HTTP response codes, or page content could further clarify the threat’s scope.