mail[.]maplcloud[.]us

This domain, mail.maplcloud.us, has been confirmed as a credential theft phishing site designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the infrastructure aligns with common phishing campaigns targeting enterprise and personal email accounts. The domain exhibits characteristics typical of credential harvesting operations, including the absence of legitimate branding and the use of generic login interfaces to trick victims into disclosing sensitive information. Infrastructure analysis reveals the domain was registered on March 24, 2026, through NameSilo, LLC, a registrar frequently utilized in phishing operations due to its accessibility and low-cost domain offerings. The domain resolves to the IP address 199.79.63.68, hosted in the United States under a provider known for harboring malicious activity. As of the latest scan, 12 out of 95 security vendors on VirusTotal flagged mail.maplcloud.us as malicious, while it appears on one additional security blocklist. Notably, the domain lacks an SSL certificate, a red flag for phishing sites as it indicates an absence of basic security measures to protect transmitted data. The domain has since been taken offline, likely in response to detection by security mechanisms such as PhishDestroy. However, the elevated risk level persists due to the domain's recent registration and the potential for reactivation under a different IP or registrar. Users and organizations are advised to block the domain and its associated IP at the network level, monitor for similar domains registered through the same registrar, and implement multi-factor authentication to mitigate the risk of credential theft. Continuous vigilance is recommended, as threat actors often reuse infrastructure for subsequent campaigns.