comercio41[.]edu[.]pe

The domain comercio41.edu.pe has been identified as a credential theft phishing site targeting users through fraudulent educational institution branding. Analysis indicates the domain is currently offline, though prior activity suggests it was designed to harvest login credentials under the pretense of an academic portal. The page title 'Home - Comercio 41' aligns with tactics used to mimic legitimate educational resources, increasing the likelihood of user deception.

Infrastructure analysis reveals the domain was registered through NIC.PE and resolves to the IP address 185.181.252.43. It is flagged by 2 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, indicating no reputable standing. The domain appears on one security blocklist and uses a Let's Encrypt SSL certificate, a common tactic to appear legitimate while lacking proper validation. These indicators, combined with its offline status, suggest prior malicious intent.

Given the elevated risk level and historical activity, organizations should block the domain and associated IP at the network perimeter. Security teams are advised to monitor for related domains using similar naming conventions or infrastructure. End-users should be reminded to verify educational portals directly through official institution channels rather than clicking unsolicited links, particularly those mimicking academic branding.