forms[.]marketingsbu[.]com[.]uy

This domain, forms.marketingsbu.com.uy, is currently active and flagged for credential theft targeting users through deceptive login portals. Analysis indicates the infrastructure is designed to harvest sensitive account credentials, likely for financial or corporate exploitation. The domain remains operational as of the latest verification, posing an ongoing risk to unsuspecting users. Infrastructure analysis reveals the domain resolves to the IP address 169.54.196.205, hosted on AS36351 within a US-based cloud environment. It is flagged by 6 of 95 security vendors on VirusTotal, with detections spanning phishing and malicious URL categories. The domain appears on two security blocklists, including PhishDestroy and OpenPhish, and employs a Let's Encrypt SSL certificate (YR2), a common tactic to lend false legitimacy. The registrar details and creation date are not publicly disclosed, but the hosting provider’s infrastructure suggests a transient or bulletproof setup. The current status of forms.marketingsbu.com.uy remains active, with no indication of takedown or mitigation. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. End-users should avoid interacting with any communications or links referencing this domain, particularly those prompting login or credential submission. Security teams are recommended to monitor for related indicators, including subdomains or IPs within the same ASN, and update detection rules to account for evolving tactics in credential theft campaigns.