am40[.]1[.]com[.]ar

This domain, am40.1.com.ar, is identified as a credential phishing site targeting users of webmail services. The page title, 'Webmail :: Welcome to Webmail,' suggests an attempt to mimic legitimate email login portals, likely aiming to deceive users into submitting their credentials. No specific drainer kit or brand impersonation beyond generic webmail interfaces is confirmed, though the infrastructure aligns with common phishing tactics observed in credential harvesting campaigns. Analysis indicates the domain was registered on February 21, 2026, through the registrar nic.ar, a regional entity responsible for .com.ar domains. It resolves to the IP address 181.225.136.40, hosted under AS47869 (ColoHouse LLC) in the United States. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 17 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (R10), a common choice among phishing operators due to its free and automated issuance process. No Google Safe Browsing (GSB) detection is explicitly noted, though the blocklist presence and vendor detections confirm malicious intent. As of the latest assessment, am40.1.com.ar has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a residual risk, as domains registered through the same registrar or hosted on the identified IP may reappear under similar schemes. Organizations are advised to monitor for related indicators, including the IP address 181.225.136.40 and domains registered via nic.ar with recent creation dates. Users should verify webmail login portals via official channels and employ multi-factor authentication to mitigate credential theft risks.