mitloud-marco[.]space

mitloud-marco.space is a phishing domain targeting cryptocurrency users by imitating a wallet connection page. The site was detected by PhishDestroy on its creation date, April 22, 2026, and quickly taken offline. Despite having no VirusTotal detections, its early identification highlights the advantage of upstream threat intelligence in catching malicious domains before they propagate through antivirus databases.

The domain was registered with Registrar of Domain Names REG.RU LLC and hosted on an IP address managed by Lefkoff Industries in the United States. The SSL certificate was issued by Let's Encrypt, a common choice for threat actors due to its free and automated nature. The platform risk score of 68 out of 100 indicates a moderate threat level, suggesting the site was well-constructed to deceive users into compromising their cryptocurrency wallets.

With the page titled "Connect Wallet," the site likely aimed to harvest sensitive information from unsuspecting users attempting to link their crypto wallets. The presence of the domain on one public blocklist, specifically PhishDestroy, underscores its malicious intent. This case exemplifies how phishing domains exploit the critical window between registration and widespread detection, emphasizing the need for proactive threat intelligence solutions.