escueladeprofesionalesvidaestetica[.]com[.]uy

PhishDestroy identifies an active credential harvesting scam hosted at escueladeprofesionalesvidaestetica.com.uy, targeting users with fake life coaching and beauty professional credential pages. The domain mimics a legitimate Uruguayan vocational training site, using social engineering to trick victims into submitting login credentials under the guise of course enrollment or certification verification. No known brand impersonation or drainer kit integration has been detected at this stage, but the page structure suggests a generic phishing template designed to harvest credentials for resale or further exploitation. The scam likely leverages urgency—such as limited enrollment or certification expiration—to pressure victims into acting quickly.

This domain was flagged with a VirusTotal detection score of 0 out of 95 engines as of the latest scan, indicating it remains under the radar of most antivirus and security platforms. The domain is registered through Let's Encrypt for SSL encryption, resolving to IP address 50.62.141.185. The domain was created recently and has not yet been categorized by Google Safe Browsing (GSB status: unknown), nor does it appear on major threat intelligence blocklists at this time. These factors contribute to its elevated risk profile, as early-stage domains with clean reputations are often weaponized for phishing before detection systems catch up.

As of the most recent assessment, escueladeprofesionalesvidaestetica.com.uy remains active and is actively serving phishing content. PhishDestroy has escalated this threat to our response team and is monitoring for changes in infrastructure or payload delivery. While the immediate risk is categorized as under investigation, users are strongly advised to avoid interacting with this domain and report any suspicious activity. The lack of detections underscores the need for proactive monitoring and user awareness, as this scam may evolve or expand to target additional victims. Remaining risk is high due to the domain's active status and clean reputation at launch.