portalclientesmovstar[.]com

This domain, portalclientesmovstar.com, is identified as a credential theft portal specifically designed to impersonate Movistar, a telecommunications provider. The site presents a fraudulent login interface titled Movistar Portal de Recaudos, targeting users who may be tricked into entering sensitive account credentials. Such attacks typically harvest usernames, passwords, and other personal data, which can later be exploited for unauthorized account access, financial fraud, or identity theft. The threat is particularly elevated due to the convincing branding and the use of a seemingly legitimate domain structure, which increases the likelihood of successful deception. Analysis of the domain infrastructure reveals multiple indicators of malicious activity. The domain was registered on December 17, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with fraudulent domains. It resolves to the IP address 44.223.200.142, hosted on Amazon.com, Inc. infrastructure (AS14618). Detection metrics further confirm its malicious nature, with 18 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, reinforcing its classification as a high-risk credential theft operation. The SSL certificate, issued by Amazon RSA 2048 M04, does not mitigate the threat, as phishing sites commonly use valid certificates to appear legitimate. Users who may have visited portalclientesmovstar.com or entered credentials on the site should take immediate action to mitigate potential risks. First, any passwords entered on the site should be changed immediately across all platforms where the same credentials may have been reused. Affected individuals should also monitor their accounts for unauthorized activity, such as unusual login attempts or transactions. Enabling multi-factor authentication (MFA) on all critical accounts can provide an additional layer of security. If financial or personal data was submitted, users are advised to contact their financial institutions to report potential fraud and consider placing a fraud alert on their credit files. Finally, reporting the domain to relevant cybersecurity organizations can aid in broader threat mitigation efforts.