factorenergia[.]org

This domain, factorenergia.org, is flagged for brand impersonation targeting Microsoft, specifically mimicking Outlook login portals. Analysis indicates the infrastructure is designed to deceive users into submitting credentials, likely for account compromise or follow-on phishing campaigns. The page title explicitly displays 'Outlook,' reinforcing the impersonation of Microsoft's email service, a common tactic in credential harvesting schemes. Infrastructure analysis reveals the domain was registered on December 22, 2021, through OVH sas and currently resolves to the IP address 188.114.97.3, located in Canada and associated with CloudFlare, Inc. Security vendor assessments on VirusTotal show 20 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a detail that may lend false legitimacy to unsuspecting users. As of the latest assessment, factorenergia.org remains active and poses an elevated risk to users. The domain has not been taken down by the registrar or hosting provider, and its CloudFlare-protected status complicates mitigation efforts. Organizations and individuals are advised to block the domain at the network level and monitor for related indicators of compromise, such as unusual login attempts or phishing emails directing users to this portal. Given the 20/95 detection rate, endpoint protection and email filtering systems should be updated to include this domain in their threat signatures.