lasfuerzasestanenelcielo[.]com

This domain is flagged as an active credential harvesting phishing site targeting Spanish-speaking users under the guise of a themed portal titled 'Las fuerzas están en el cielo – LFEEEC.' Analysis indicates a high likelihood of credential theft, where victims are tricked into entering sensitive login information through deceptive web forms. The threat type is classified as generic_phishing with an elevated risk level due to its recent registration and confirmed malicious activity. Infrastructure analysis reveals the domain was registered on July 19, 2025, through Internet Domain Service BS Corp and resolves to the IP address 185.208.156.66. It appears on one security blocklist and is currently offline, though prior activity was detected by five out of ninety-five security vendors on VirusTotal. The domain was previously blocked by enterprise-grade security filters, indicating its use in targeted phishing campaigns. The page title 'Las fuerzas están en el cielo – LFEEEC' suggests an attempt to impersonate a legitimate entity or service to lure victims. Mitigation against this threat involves immediate blocking of the domain and its associated IP address (185.208.156.66) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to lasfuerzasestanenelcielo.com or its subdomains. End-users should be educated on recognizing phishing indicators, such as mismatched URLs, unsolicited login requests, and grammatical inconsistencies in page content. If credentials were entered on this site, affected accounts must be secured by resetting passwords and enabling multi-factor authentication. Security teams should monitor for anomalous login attempts originating from the identified IP address.