laarsmexico[.]com[.]mx

Analysis of laarsmexico.com.mx indicates active phishing infrastructure targeting users through credential harvesting. The domain was registered on April 13, 2015, through Wingu Networks S.A de C.V. and currently resolves to IP address 67.23.239.238. Nameserver records point to ns1.infinitweb.com, ns2.infinitweb.com, ns1.wsolutionsmx.com, and ns2.wsolutionsmx.com, suggesting shared hosting infrastructure commonly exploited for malicious campaigns. A Let's Encrypt SSL certificate (YR2) is deployed, providing encrypted connections to deceive targets into perceiving legitimacy. Two of 91 security vendors on VirusTotal flag this domain as malicious, while AlienVault OTX includes it in three threat intelligence pulses, further corroborating its use in phishing operations. The domain remains active as of July 18, 2026, with no confirmed takedown or sinkholing observed. Specific content hosted on the site has not been analyzed, so the exact brand or service being impersonated is unknown. However, the presence of SSL encryption and detection by multiple security sources align with typical credential phishing tactics. Defenders should treat this domain as high-risk and implement blocking at the DNS or network level. Monitoring for connections to 67.23.239.238 or the associated nameservers may help identify compromised systems within an organization. Given the domain's age and continued activity, historical logs should be reviewed for prior interactions, particularly from April 2015 onward. No evidence suggests this infrastructure is used for malware distribution or other threat types beyond phishing.