cuentacorriente[.]com[.]co

Analysis of cuentacorriente.com.co indicates that the domain was registered on May 14, 2011 through NameCheap, Inc. and continues to resolve to the IPv4 address 158.94.209.40. The authoritative name servers are dns1.namecheaphosting.com and dns2.namecheaphosting.com. The domain is currently listed as active and has been classified with a high risk rating. Detection data show that four of ninety‑five security vendors on VirusTotal have flagged the domain, and the domain appears on one external blocklist.

PhishDestroy has already added the domain to its blocklist, confirming its use in phishing campaigns. No additional public indicators such as SSL certificate details, HTTP status codes, page title, or Safe Browsing verdicts were provided in the intelligence feed. Consequently, the precise phishing payload, targeted brand, or lure technique remain unknown. Defenders should ensure that outbound traffic to 158.94.209.40 is monitored and, where possible, blocked.

Existing DNS filtering solutions should be updated to include the domain and its associated name servers. Endpoint protection platforms should be configured to treat any detection from the four VirusTotal‑flagged vendors as malicious. Continuous threat‑intel monitoring is advised to capture any future changes, such as additional blocklist listings or new vendor detections, which could clarify the phishing campaign’s scope.