carbonellsrl[.]com[.]ar

This domain, carbonellsrl.com.ar, is identified as a credential harvesting phishing site designed to deceive users into submitting login credentials through fraudulent web forms. Analysis indicates the infrastructure was actively used for generic phishing campaigns, though no specific brand impersonation has been confirmed. The domain is currently offline, but prior activity suggests it operated as a low-interaction phishing endpoint. Infrastructure analysis reveals the domain was registered through nic.ar on August 28, 2020, and resolved to the IP address 200.80.43.220, located in Argentina under AS18747 (IFX Corporation). Security vendors flagged the domain in 21 of 95 VirusTotal scans, while two independent blocklists (PhishDestroy and PhishingDB) listed it as malicious. The site presented an "Index of /" directory listing, a common indicator of misconfigured or intentionally exposed phishing infrastructure. The SSL certificate was issued by Let’s Encrypt (R12), a detail often exploited by threat actors to lend superficial legitimacy to malicious sites. As of the latest verification, carbonellsrl.com.ar has been taken offline, likely due to hosting provider intervention or registrar enforcement. Organizations are advised to block the domain and its associated IP (200.80.43.220) at the perimeter, update endpoint detection rules to include the domain’s hash signatures, and monitor for residual phishing attempts leveraging similar infrastructure. Historical DNS and WHOIS records should be preserved for forensic purposes, and affected users should be notified to reset credentials if exposure is suspected.