ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is domains@fundacionprivacy.com.
The latest stored availability evidence still shows the domain reachable; 1 month has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations.
This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
ww547.loutlook.com is an impersonation phishing page built to pass as Microsoft Outlook. The page simply calls itself "outlook", and the domain adds a single leading "l" to the real brand name, a typo that is easy to miss in a link or the address bar. It targets anyone who signs in to Outlook webmail, including people whose crypto exchange and wallet accounts are tied to that inbox. PhishDestroy first flagged it on 2026-09-09, and it was still online and serving content on 2026-10-19.
How the scam works
Victims usually arrive through an email or message warning about a full mailbox, a blocked account or a pending document, with a link that opens what looks like the Outlook sign-in screen. Any address and password typed there go straight to the operators, not to Microsoft. With the inbox in hand, attackers can reset passwords on linked services, intercept exchange withdrawal confirmations and verification codes, and send further phishing to the victim's contacts from a trusted address.
Evidence
On 2026-09-18, VirusTotal showed 14 of 89 security engines flagging the site. They include BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft and Kaspersky, several of them widely deployed browser and endpoint protections. That is a meaningful minority rather than a consensus, so many browsers and filters may still let the page load without a warning. PhishDestroy lists the domain on its own blocklist.
Infrastructure
The parent domain loutlook.com was registered on 2012-03-02 through Media Elite Holdings Limited, more than fourteen years before PhishDestroy detected this page. The phishing content sits on a numbered subdomain of that long-held lookalike name rather than on a freshly registered domain. It is hosted on Google LLC infrastructure in the United States, on the address 34.160.121.137.
What to do
If you entered your Outlook or Microsoft credentials on this page, change the password immediately from the official Microsoft site and sign out of all active sessions. Turn on or reset two-factor authentication. Check your security info, recovery addresses and inbox forwarding or filter rules for anything you did not add. Then change passwords on any exchange, wallet service or other account that uses this email for recovery, and watch for unexpected reset or withdrawal emails. Defenders should block the domain and its hosting address at mail gateways and web proxies, and search logs for users who visited it or received links to it.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(PA)
