listado[.]mercadolibre[.]cl

Analysis indicates that the domain listado.mercadolibre.cl was registered on February 21, 2026 and is currently resolving to the IP address 13.226.244.86, which belongs to Amazon’s infrastructure in Germany (AS16509). The SSL certificate presented is an Amazon RSA 2048 M01 certificate, and the domain is served through Amazon CloudFront, as reflected by the nameserver entries d2j8vqhorlxvj3.cloudfront.net, ns-537.awsdns-03.net, and ns-1307.awsdns-35.org. HTTP requests receive a 302 redirect, and infrastructure fingerprints reveal the presence of Envoy, Tengine, Zipkin, HSTS, and other Amazon‑related components. VirusTotal scanning shows three of ninety‑three security vendors flagging the domain, and it is listed on the PhishDestroy and PhishingDB blocklists, confirming its classification as an active high‑risk e‑commerce phishing campaign. While the page title “Mercado Libre” aligns with the reported e‑commerce scam type, the actual page content has not been publicly analyzed, leaving the exact payload and credential‑capture mechanisms uncertain. Defenders should immediately block both the domain and its resolved IP address at perimeter and DNS filtering layers, monitor for outbound connections to the identified CloudFront endpoints, and consider adding the domain to threat‑intel feeds for automated enforcement. Continuous re‑evaluation is advised in case the infrastructure changes or additional indicators emerge.